Hello colleagues,
Is binary copy of the hard drive removed from surveillance recorder make sense ?
I mean if binary copy of hdd removed from surveillance recorder will be correctly readable by forensics software without the original surveillance recorder ?
I know that hard drive from recorder don't have a standard file system. I used FTK Imager to see that this hdd has tousands of .dat files.
Thanks in advance for any response
Hello colleagues,
Is binary copy of the hard drive removed from surveillance recorder make sense ?
I mean if binary copy of hdd removed from surveillance recorder will be correctly readable by forensics software without the original surveillance recorder ?
I know that hard drive from recorder don't have a standard file system. I used FTK Imager to see that this hdd has tousands of .dat files.
Thanks in advance for any response
As a matter of fact, EXACTLY BECAUSE commonly used forensic softwares have difficulties with these "custom" filesystems (or whatever) it is VITAL to make raw images of them.
There are specialized tools for DVR's that may (or may be not) "forensic sound", so it is entirely possible that while they might allow to decode/see/convert the contents of such disks, they may alter - even subtly - the media, hence the importance on always working on an image.
In other words, NO matter the source (DVR, PC, whatever), and no matter what kind of access/copy/view/data extraction you are going to perform, ALWAYS make one (or more) images of the original and NEVER work on the original.
jaclaz
