Forensic data retrieval with Image Mounter and proprietary file system drivers

After forensic experts have collected digital evidence from the crime scene, there is still quite some challenge to retrieve the evidential data that can be used in a courtroom.

Three common challenges in forensic data retrieval are:

  1. Risk of irreversible media damage when connecting to a regular OS
  2. Quicker loss of sensitive data obtained from unallocated space on SSDs.
  3. Files are formatted under the file system different from forensic examiner’s computer.

To overcome these challenges, advanced forensic software is needed. You cannot retrieve the data without mounting the images first. A forensic image is a complete copy of a hard drive or other digital media intended for use as evidence. A forensic image usually includes files, unallocated space, slack space, and boot record. Forensic data, such as deleted files, file fragments or any hidden data may be found in slack or unallocated space. If sanitization software is used to completely wipe off any traces of information on a drive, then it is very unlikely that forensic examiners will succeed in retrieving any data. …

About

Paragon Software Group

Storage management, data safety and disaster recovery software for home and business users – www.paragon-software.com

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store