Forensic Features

With a forensic investigation of a disk there are several very important points to note.  These include

  • Original data must not be changed in anyway
  • Full details of all files to be obtained - dates etc
  • Full details of history of disk - last written to, how many sessions on a DVD
  • Logs of all operations and errors encountered
  • Slack disk space recovery
  • File signatures checking
  • MD5 hash values for all files extracted

One very important on forensic recovery is that at times, file names are changed to disguise the file type. The CnW Recovery file signature routine will detect file types irrespective of how they have been named.  We can therefore restore just the required file types.

The recovery logs will also indicate where data has been written to a disk so examiners can investigate files at a sector level if required. These can all be sorted, so that certain categories found easily, or they may be exported as comma delimited files for processing in standard database packages.

 

 

 

 

CnW Recovery  Lewes   East Sussex  UK

 

[CnW Recovery] [Services] [Lost photos] [Technical notes] [Disk Image] [Erased DVD-RW] [DVD Recovery] [Lost Video disks] [GoPro Recovery] [Erased CD-RW] [Drive recovery] [Deleted files] [Zip disk drive] [Jaz Drive] [CD Recovery] [Forensics] [File dates] [UDF disks] [FAT Disks] [NTFS disks] [RAID Recovery] [Prevention] [ISO9660 disks] [MD5 hash] [File signatures] [Flash memory] [Boot sector] [Unallocated] [Raw recovery] [Encrypted Files] [File selection] [Mac Recovery] [NTFS reloaded] [Defrag progs] [Failed  chips] [3GP and MP4] [Formatted Video] [Price guide] [Online Payments] [FAQ Disks] [FAQ CD & DVD] [FAQ Memory] [Send Job] [Useful Links] [PC repairs] [Contact Us] [Site map] [About Us]