ShmooCon 2014: You Don't Have the Evidence
For more information visit: http://bit.ly/shmooc14
To download the video visit: http://bit.ly/shmooc14_down
Playlist Shmoocon 2014: http://bit.ly/shmooc14_pl
Speaker: Scott Moulton
Forensic imaging tools have one purpose, to soundly copy every sector on a device to a destination device and report success or failure without changing data. In the last 20 years most forensic imaging tools have not progress and continue to use the same basic code for imaging a drive. When encountering damage many of the tools have no ability to deal with the damage and quit, crash, or worse; do more damage to the drive they are trying to recover from. Imaging damaged drives are where forensic tools are delivering the most disappointing results.
Data Recovery tools and skills are important when acquiring the data from damage disks, but also understanding what you are not getting when imaging a forensic job is just as important. There are special ways to access the data, the controller on the hard drive, repair the damaged boards, and even to adjust heads by turning off damaged ones, copying all the data from the good platters before dealing with the damaged heads. Data recovery imaging tools have some very advanced functions and capabilities for imaging damaged hard drives and damaged sectors that forensic tools are incapable of finishing. I will be discussing these different techniques and the errors exhibited by the drive and sectors to better help understand what you are missing and why.
Watch video ShmooCon 2014: You Don't Have the Evidence online without registration, duration hours minute second in high quality. This video was added by user Christiaan008 21 April 2014, don't forget to share it with your friends and acquaintances, it has been viewed on our site 1,26 once and liked it 1 people.