Solid State drives (SSD) introduced dramatic changes to the principles of computer forensics. Forensic acquisition of computers equipped with SSD storage is very different of how we used to acquire PCs using traditional magnetic media. Instead of predictable and highly possible recovery of information the suspect attempted to destroy, we are entering the muddy waters of stochastic forensics where nothing can be assumed as a given.

Learn More & Download the PDF

Despite our efforts to educate everyone in the digital evidence chain on the proper way to label and care for CDs, DVDs, and BDs (see CD and DVD Care and Handling: Stop Destroying Your Evidence!), read errors still happen...a lot. Here are two of my favorite tools for repairing and recovering data from disc-based media.

Although disc-based storage is not as widely used as it once was for digital evidence archiving, it remains a viable solution when properly implemented and managed. In fact, many of the world’s largest technology companies are using and/or exploring disc-based storage systems for long-term offline storage of petabytes of customer data (e.g. Facebook uses 10,000 Blu-ray discs to store 'cold' data). They do so, however, in a managed environment with a thorough understanding of the medium’s strengths and limitations.

Many in law enforcement use write-once disc-based media for MASTER evidence storage, as it continues to be recommended via various industry best practice documents. Unfortunately, not everyone involved in the evidence chain understands the limitations and best practices as they relate to the care and handling of disc-based media. Adhesive labels, permanent markers, and ballpoint pens have destroyed more evidence than I care to even think about.

One of the tools many of us keep in the toolbox for recovering from CD/DVD was recently updated to support other types of media, to include removable drives and hard disks.  It's also added support for NTFS.  Not familiar with IsoBuster?  Check it out at www.isobuster.com

As USB thumb drives and memory cards get larger and cheaper, it's getting easier to trust much more of your data to them. It's also much easier to mistakenly erase data or have them hiccup on you. And if you're in the habit of holding on to that data for too long -- for example, not transferring photos from your camera's memory card -- disaster is almost guaranteed to strike at some point. What happens then?

Full Story

Just back from vacation and read Jennifer Apple's post on this tool.  I keep this one with me on a thumb drive when I'm out and about.  If you're not familiar with it check out Jennifer's post at photoshopsupport.com.

Full Story

As demonstrated in a series of articles published earlier in this blog, solid-state disks (SSD) tend to wipe deleted information on their own pace due to the way their garbage collection mechanism is designed. Wiped information cannot be recovered by any means, not even with expensive hardware, and not even by pulling flash memory chips out. It’s gone forever.

Full post

The FREE Windows File Recovery app is in the news again this week, with The Verge, ZDNet and others reporting on this "new" utility/tool.

Although it's not "new", as it was released in January, you likely haven't had a version of their OS that can run it until recently, unless you're an insider or developer. It is command line tool, but pretty simple to use (think PhotoRec/TestDisk). It can be used to recover from internal drives, HDD or SSD drives, cameras, USB and flash card storage. You'll need Win 10 version 19041.0 or higher.