Ryan,
I just sent you a message on this site regarding the volume shadow copy feature in ILookIX.
Dave
You can easily view VSC folder contents with FAR manager software (free file explorer).
I think what the world of forensics has been missing for a decade is now landed on the shores, and almost no one wants the immigrants to get off the ship. D
I think what is missing is attribution of your spam blast of posts.
In only one post have you identified yourself as "Jim Baker, CEO Perlustro lP". In the rest you intimate you are a user, a LEO, etc.
RESPONSE
Firstly I never identified myself as Jim baker, (I am not Jim Baker) I stated that I asked Perlustro the question and Jim baker replied, and the second part is correct.
Regards,
Cressida
And here
http//www.forensicfocus.com/Forums/viewtopic/p=6562172/#6562172
you identified yourself as a representative of the company.
Now - as I see it - one thing is to say "I asked a question to the company that makes the software" and another one is "I asked a question to the top management of the company that makes the software and of which I am a representative". (both sentences are correct ) , only they give - at least to me - a different impression)
At least it makes perfectly "normal" the otherwise very little plausible fact that the CEO of a (biggish) software company replies (and with a lengthy and well structured letter) to a question asked by a customer , it is not the CEO that writes in reply to an end customer, but a CEO that writes to one of his representatives.
I mean, I must have lost during a move the letter Bill Gates sent to me when I asked him about why NT 3.5 did not support HPFS…. roll
jaclaz
1. The moment I made my first post (YOU FLAMED ME) I was writing the post as a long time user of the products (not a representative)
First thing I didn't flame you at all, I was very curious about the reason why you posted three times in half an hour about the tool, and apart the continuously putting on and off the hat of representative of the Perlustro Company, I think that I have understood
2. I want the best deal for all forensic investigators commercial/government and LEO's, (that is why I represent the company)
I see, and of course the wage/sale commissions/whatever monetary advantage you get by promoting the tool is given to a charity association, right?
3. I will now answer any posts leaving the company brand out, as I mentioned before, (already removed from original posts)
Not a problem, it is in my posts and in the quotes of your original posts inside mine.
4. I know Jim and Company X will happily compare any tool with ours, and put his money where my mouth is, in fact he is currently offering US $10000, for any body that believes they have a faster imager. Contact Jim Baker Company X
I have no doubt - as I wrote by now several times - that the IlookX tool is a very good one, that the Perlustro Company makes good products, and that you and Mr. Baker are very nice people.
5. There is a paradigm shift happening in Forensics, and with the huge amounts of data that have to be searched things have to change, Company X have a tool that can search 10000 computers simultaneously, the computers can be on the other side of the world and you can execute it from here where ever here is. But that probably doesn't interest you, as you will probably flame me for advertising.
And again I am not at all flaming you for advertising, which is perfectly OK AFAICT, I expressed my opinion (a personal opinion which is part of my freedom) on the fact that your posts seemed a "fake review" or "masked advertising", which is NOT "plain" advertising.
6. I am only trying to make people aware of what many don't know about, without all the marketing hype.
Well, you succeeded in making members of the forum aware (those that weren't already), but if the idea was to do it without the marketing hype, you IMHO failed.
I am however taking note of the "paradigm shift" and I will surely, as soon as I will need to "search 10,000 computers simultaneously on the other side of the world" , contact your company, thanks for making me aware about this feature of the tool.
jaclaz
Is it possible that in volume shadow copie file are saved data from RAM memory ??
In my case I've found in volume shadow copie file (eg. {sdasdfsdfsdfsdfsdfas}{gdfgdfgdfgdf}) some interesting text using text search option in EnCase. When I opened this file using tools EnCase, vssadmin and mklinks, I didn't find any file where the interesting text is stored. I haven't any idea what's going on ? I suppose the text was stored in RAM when Volume Copy Shadow was created. Is it right thinking ?