|
"When you copy a hard drive, you only get the data that is currently on it.
There are forensic techniques on the orignal drive that will let you see not only what is on it, but what has been on it for up to seven generations of erasure."
A forensic investigator will NEVER work on the original drive. The reason being that it would be too easy for a defence lawyer to claim that the tests and procedures used by the investigator alter or damage evidence.
What is done is that a clone is taken from the original drive, this clone or copy is not your average copy *.* but a bit for bit copy of the drive.
The resulting copy is an exact duplicate of the drive, and contains the remnants of deleted files.
The original drive is then locked away in an evidence vault for safekeeping.
|
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
