User avatar
Jared
Forum Admin
Posts: 3492
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Good Software or Hardware Tool For Field Acquisition

Tue Aug 30, 2016 5:21 pm

Anyone care to recommend a good tool used for field acquisition of a HDD in the field that is forensically sound? I have a customer who wants to pay me to drive two hours away to image a drive and attempt recovery. I already know lawyers are involved, and I keep telling them I'm not a forensics person, but they are very insistent.

I know a million ways to make a perfect clone, but just in case this does turn into an investigation later I'd rather err on the side of caution and do it all forensically sound right now.

jol
Data Recovery Pro
Posts: 641
Joined: Thu Jan 29, 2015 11:31 pm

Good Software or Hardware Tool For Field Acquisition

Tue Aug 30, 2016 6:48 pm

What about rapidspar ?

User avatar
pclab
Forum Moderator
Posts: 1588
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Good Software or Hardware Tool For Field Acquisition

Wed Aug 31, 2016 3:45 am

FTK imager is not good enough?
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
lcoughey
Forum Moderator
Posts: 581
Joined: Mon Jan 12, 2015 12:46 pm
Location: Ontario, Canada
Contact: Website Facebook Twitter Google+

Good Software or Hardware Tool For Field Acquisition

Wed Aug 31, 2016 9:51 am

jol wrote:What about rapidspar ?

Not a bad idea. Embed the cost of a new RapidSpar unit into your price quote, but be sure to include the Data Acquisition add-on.

User avatar
Jared
Forum Admin
Posts: 3492
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Good Software or Hardware Tool For Field Acquisition

Wed Aug 31, 2016 2:04 pm

pclab wrote:FTK imager is not good enough?


I was actually leaning toward this one. I like that it'll generate an Encase image file and calculate checksums. Do you happen to know if it can then convert the E01 file to a RAW image for me to work with in finding the lost data?

User avatar
Jared
Forum Admin
Posts: 3492
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Good Software or Hardware Tool For Field Acquisition

Wed Aug 31, 2016 2:04 pm

lcoughey wrote:
jol wrote:What about rapidspar ?

Not a bad idea. Embed the cost of a new RapidSpar unit into your price quote, but be sure to include the Data Acquisition add-on.


Does RapidSpar have a forensics mode where it'll calculate checksums?

Edit: I see it does seem to have a Data Acquisition Add-On: http://rapidspar.com/forensics.html
Anyone know how much this addon costs? I know the RapidSpar itself is around $2000

Double Edit: Found their prices page: http://rapidspar.com/forensics.html

User avatar
Amarbir[CDR-Labs]
Data Recovery Pro
Posts: 507
Joined: Sat Jan 17, 2015 4:35 pm
Location: Chandigarh ,India
Contact: Website Skype

Good Software or Hardware Tool For Field Acquisition

Sun Sep 18, 2016 2:10 pm

lcoughey wrote:
jol wrote:What about rapidspar ?

Not a bad idea. Embed the cost of a new RapidSpar unit into your price quote, but be sure to include the Data Acquisition add-on.


Luke Sir ,
:D I am still dying to get some feedback from you for rapidspar ,I know you are a super busy man appreciate if you could shed some light at least now
Regards
Amarbir S Dhillon ,CDR Labs [ Chandigarh ,India ]
DataRecovery - The Affordable Way In India
Youtube Channel -> https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

ScotchBroth
Data Recovery Noob
Posts: 42
Joined: Wed May 27, 2015 7:34 pm

Good Software or Hardware Tool For Field Acquisition

Wed Oct 19, 2016 7:35 pm

I know I'm late to the party. But how'd it go? I have tons of tips for you depending on the state of the drive. You're likely done already, but I'm just wondering.

User avatar
Jared
Forum Admin
Posts: 3492
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Good Software or Hardware Tool For Field Acquisition

Thu Oct 20, 2016 4:18 pm

ScotchBroth wrote:I know I'm late to the party. But how'd it go? I have tons of tips for you depending on the state of the drive. You're likely done already, but I'm just wondering.


It didn't turn out to be a case where it really needed to be forensically sound. It was evidence for a criminal case, but since we were just looking for video to try to prove the defense (not offense) it didn't have to be handled following any particular procedures. So I ended up just dd'ing the HDD to an image file on an external.

Was a wild goose chase anyway. They weren't even sure if the video was ever saved on this computer. If it had been would have been just for a minute before copying to a thumb drive. And the computer was in use for nearly six months since then, :roll: .

ScotchBroth
Data Recovery Noob
Posts: 42
Joined: Wed May 27, 2015 7:34 pm

Good Software or Hardware Tool For Field Acquisition

Sun Oct 23, 2016 6:49 pm

If it had been would have been just for a minute before copying to a thumb drive. And the computer was in use for nearly six months since then


Bah, I hate that.


Anyways, Paladin from Sumeri Forensics is a good bootable forensic imager. Good for PC and Mac. gotta be quick on the draw though with some bootup menus :D

Speaking of forensic imaging, does anyone use the DDI forensic addon? Whenever I do to make a DD of a drive the NTFS filesystem is undetectable by windows. I'm not certain why (I haven't dug into it really) Just wondering if anyone's experienced it and has a fix.

Return to “Forensic Tools”

Who is online

Users browsing this forum: No registered users and 0 guests