You Don't Have the Evidence

ShmooCon X - 2014

Presented by: Scott Moulton
Date: Sunday January 19, 2014
Time: 12:00 - 12:50
Location: Bring It On room
Track: Bring it On

Forensic imaging tools have one purpose, to soundly copy every sector on a device to a destination device and report success or failure without changing data. In the last 20 years most forensic imaging tools have not progress and continue to use the same basic code for imaging a drive. When encountering damage many of the tools have no ability to deal with the damage and quit, crash, or worse; do more damage to the drive they are trying to recover from. Imaging damaged drives are where forensic tools are delivering the most disappointing results.

Data Recovery tools and skills are important when acquiring the data from damage disks, but also understanding what you are not getting when imaging a forensic job is just as important. There are special ways to access the data, the controller on the hard drive, repair the damaged boards, and even to adjust heads by turning off damaged ones, copying all the data from the good platters before dealing with the damaged heads. Data recovery imaging tools have some very advanced functions and capabilities for imaging damaged hard drives and damaged sectors that forensic tools are incapable of finishing. I will be discussing these different techniques and the errors exhibited by the drive and sectors to better help understand what you are missing and why.

Scott Moulton

Scott Moulton is known both for his trademark 'Forensic Unit' hat and his unholy knack for finding new data recovery techniques the other experts don't want you to know. Scott is owner of both My Hard Drive Died.com and Forensic Strategy Services and fills his days recovering data from all kinds of storage devices, testifying in court, and teaching others to do data recovery. Scott teaches a full 5 Day Forensic Bootcamp Data Recovery Class that includes advanced repairs of badly damaged drives and all the tools used by Data Recovery and Forensic shops. Scott's DIY videos are on www.MyHardDriveDied.com


KhanFu - Mobile schedules for INFOSEC conferences.
Mobile interface | Alternate Formats