±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35144
New Yesterday: 1 Visitors: 160

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Binary copy of HDD from surveillance recorder

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Binary copy of HDD from surveillance recorder

Post Posted: Sun Sep 30, 2018 1:01 pm

Hello colleagues,

Is binary copy of the hard drive removed from surveillance recorder make sense ?

I mean if binary copy of hdd removed from surveillance recorder will be correctly readable by forensics software without the original surveillance recorder ?

I know that hard drive from recorder don't have a standard file system. I used FTK Imager to see that this hdd has tousands of .dat files.

Thanks in advance for any response  

Thomass30
Senior Member
 
 
  

Re: Binary copy of HDD from surveillance recorder

Post Posted: Mon Oct 01, 2018 2:56 am

- Thomass30
Hello colleagues,

Is binary copy of the hard drive removed from surveillance recorder make sense ?

I mean if binary copy of hdd removed from surveillance recorder will be correctly readable by forensics software without the original surveillance recorder ?

I know that hard drive from recorder don't have a standard file system. I used FTK Imager to see that this hdd has tousands of .dat files.

Thanks in advance for any response


As a matter of fact, EXACTLY BECAUSE commonly used forensic softwares have difficulties with these "custom" filesystems (or whatever) it is VITAL to make raw images of them.

There are specialized tools for DVR's that may (or may be not) "forensic sound", so it is entirely possible that while they might allow to decode/see/convert the contents of such disks, they may alter - even subtly - the media, hence the importance on always working on an image.

In other words, NO matter the source (DVR, PC, whatever), and no matter what kind of access/copy/view/data extraction you are going to perform, ALWAYS make one (or more) images of the original and NEVER work on the original.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 

Page 1 of 1