My It department have installed Perfect Disk -Defrag tool, which runs all the time optimising the disk resources.
How would this affect any evidence stored on a host?
If the 'evidence' is in the form of active files then I suspect there should be no problem. If, however the evidence is in deleted, lost or in unallocated space then there is every chance that the movement of active files as part of the defrag process will overwrite at least some of these.
I say this, but to be honest I don't know how Perfect Disk operates, I am making an assumption that it is little better than a scheduled 'defrag C' command.
Paul
Paul, you are quite correct. PerfectDisk and similar tools make evidence acquisition or even deleted file recovery very difficult. I have encountered this on several occasions. The files are listed in the MFT, however when data carving is performed, the result is junk files filled with binary jibberish.
I agree entirely with binarybod.
There is another side to the 'equation' If the drive gets badly corrupted, it can be easier to recover files that are not fragmented.
If your eveidence stored on the host is in the form of DD, or E01 type files no problem with system defragmenting
If however you plug an evidence disk in, without a write blocker, then a defrag operation would do lots of damage. However, I don't think you are describing this.