Free DME & DFIR Resources

Although disc-based storage is not as widely used as it once was for digital evidence archiving, it remains a viable solution when properly implemented and managed. In fact, many of the world’s largest technology companies are using and/or exploring disc-based storage systems for long-term offline storage of petabytes of customer data (e.g. Facebook uses 10,000 Blu-ray discs to store 'cold' data). They do so, however, in a managed environment with a thorough understanding of the medium’s strengths and limitations.

Many in law enforcement use write-once disc-based media for MASTER evidence storage, as it continues to be recommended via various industry best practice documents. Unfortunately, not everyone involved in the evidence chain understands the limitations and best practices as they relate to the care and handling of disc-based media. Adhesive labels, permanent markers, and ballpoint pens have destroyed more evidence than I care to even think about.

The multimedia evidence community has been really buzzing the last couple of years in regards to how useful FFmpeg and Libav can be for dealing with proprietary video formats. Both tools are extremely useful in several aspects of a forensic DME workflow. With that said, however, whether it’s FFmpeg, Libav or another 3rd party tool, there are limitations and causes for concern when using them to process proprietary video file formats.