irs
Data Recovery Noob
Posts: 43
Joined: Wed Feb 04, 2015 3:52 am
Location: Italy
Contact: Website

Re: F.L.A.M.E. - A new tool for data recovery

Fri Feb 13, 2015 1:22 am

The police and forensic experts should always work on a full copy through a write blocker like a tableau or on an image file and always compare hashing value with the original one ...
As I know changing LBA content is forbidden, skipping sectors filling with defined pattern on the copy and hashing declaring skipped sectors MAY be allowed.
Luca Marella

Data Recovery pro in Italy
http://www.ultrarecovery.com

User avatar
Jared
Forum Admin
Posts: 3851
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: F.L.A.M.E. - A new tool for data recovery

Fri Feb 13, 2015 8:54 am

I think this is one that will vary by country. Here I think standard practice is that the MD5 hash of the copy needs to match the original (which generally is expected to be write blocked). So changing any bits would throw that off. However if you did the AA BB adjustment while working and then set it back when finished, I suppose it'd still check out then.

User avatar
lcoughey
Forum Moderator
Posts: 655
Joined: Mon Jan 12, 2015 12:46 pm
Location: Ontario, Canada
Contact: Website Facebook Twitter Google+

Re: F.L.A.M.E. - A new tool for data recovery

Fri Feb 13, 2015 9:45 am

I've always made at least 3 copies of a drive for forensics:

1. Exact clone with MD5 - stored in safe with original
2. Exact clone - no need for MD5, this drive is to play with, without having to worry about date and time stamps
3. Exact image file with MD5 - this is the working file that would be passed around between investigators and examined with enCase or other forensic software programs

User avatar
Jared
Forum Admin
Posts: 3851
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: F.L.A.M.E. - A new tool for data recovery

Fri Feb 13, 2015 10:20 am

Yep, the three clones process is standard practice here too.

User avatar
Jared
Forum Admin
Posts: 3851
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: F.L.A.M.E. - A new tool for data recovery

Sun Jul 26, 2015 8:29 am

Well it's been several months now, and despite the promises to Recovery Force and Data Medics we have yet to receive our beta test F.L.A.M.E. systems.

Isn't building much confidence. If IRS says the tool is legit I have to believe him, but I certainly have my doubts about what kind of company they are and how their support and updates will be.

User avatar
abedalkareem
Experienced DR Tech
Posts: 217
Joined: Mon Aug 31, 2015 12:57 pm
Location: Amman - Jordan
Contact: Website

Re: F.L.A.M.E. - A new tool for data recovery

Thu Sep 17, 2015 4:05 am

the screen shots is unavailable !!

User avatar
Jared
Forum Admin
Posts: 3851
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: F.L.A.M.E. - A new tool for data recovery

Thu Sep 17, 2015 4:28 pm

Yes, I'm not sure what happened exactly. Something got messed up on the forum and during the repair process some older threads lost all pictures. I'll have to see if the files still exist somewhere on the server.

Return to “EDR Tools”

Who is online

Users browsing this forum: No registered users and 0 guests