Good Software or Hardware Tool For Field Acquisition

Don't Lose Your Data Forever!

DIY data recovery has risks. You could lose your data forever! Don't want to risk it? Talk to a professional now.

lcoughey

Moderator
ScotchBroth":32ufbefb said:
Speaking of forensic imaging, does anyone use the DDI forensic addon? Whenever I do to make a DD of a drive the NTFS filesystem is undetectable by windows. I'm not certain why (I haven't dug into it really) Just wondering if anyone's experienced it and has a fix.
So, you are using DDI FE to make an image file, right? They tweak the NTFS file system so that it mounts in Windows as read only, as per the request of many forensic clients. I've found that this "tweak" doesn't play nice with Windows 10 (and possibly 8), but can be undone by run a quick scandisk using windows 7.
 

ScotchBroth

New member
Yes, making a bin image with DDI FE. When I plug the drive in, it can't see the bin file at all. I have to look at it with r-studio or something like it so get the image out usually.
 

eric7

New member
Really, what you want is a file-recovery tool, which is a very different function than forensic work. There are a number of other file recovery tools that will do what you want, and automatically move recovered files to a different disk/folder. A search for file recovery tools to find the feature you require, would probably be the best. I use for Windows is Recuva and Disk Drill.

[glow=red]Moderator note:[/glow] If you can't read the thread to see that this is a discussion between data recovery professionals talking about forensic imaging I have no choice but to assume you're just here to SPAM software. Data recovery software developers are more than welcome to discuss their products here, but not to pretend to be end users plugging their programs on unrelated threads.
 

RolandJS

New member
As an intermediate backup/restore person, as a beginner data recovery [first response level] person, I am interested in learning more about forensic imaging. Obviously FI is different, more complicated, than full imaging with Macrium Reflect or Imaging for Windows, correct? I'd like to learn more from the experiences of others.
 

RolandJS

New member
pclab":1qp0z5zb said:
But you want to do Data Recovery or Forensics? They are different areas...
Agreed! I'm not sure what the differences are; I can guess, however, I would rather read posts from those in the know :)
 

pclab

Moderator
Maybe first it was better for you, to tell us what you want/need to do and future expectations..
 

RolandJS

New member
pclab":81f4po3k said:
Maybe first it was better for you, to tell us what you want/need to do and future expectations..
Presently, just learning more and more about individual and small business data recovery; however, I would like learn more about Forensic imaging -- to better appreciate what youse all are doing.
 

Jared

Administrator
Staff member
When it comes to imaging there are some real differences between data recovery and forensics. In data recovery the goal is always to read out as many sectors as possible from media which is often failing. Even if the hardware is perfectly fine, an image or clone is usually still created to have a backup copy should anything go wrong during the process.

In forensics, you always have to assume that the case might go to court. This means that you'll need to be able to prove that the copy is authentic and hasn't been tampered with. You'll also need to document your exact process so that if your results are questioned another forensics investigator can replicate your same results. So for example when imaging a hard drive, it's usually standard practice to create two copies simoltaneously and to generate checksums for the images. The imaging is logged by the software and checksums recorded in the logs. Then one copy goes with the investigator who's going to analyze the data, the other usually goes to a safe location such as a safe box and is kept inaccessable to the forensics investigator. If anyone questions the evidence found on the drive and insinuates it was put there by the investigator it can easily be proven that it wasn't by comparing the checksum of the data and/or comparing the second copy.
 
Top