Most forensics imager tools do not really copy all sectors

Discussion in 'privacy technology' started by redcell, Dec 7, 2014.

  1. redcell

    redcell Registered Member

    Joined:
    Sep 27, 2010
    Posts:
    126
    I encourage FDE enthusiasts to watch this video. It reminds us how crucial to have our system to be fully encrypted. In short,

    Forensic Imager Tools: You don't have the Evidence - Shmoocon 2014
    https://www.youtube.com/watch?v=zYYCv21I-1I

    1. There are reallocated sectors happening during any imaging process. It means that (during imaging) a hard drive contents are being modified without them knowing or speaking about it.
    2. Most forensics do not really image out the hard drive 100%.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.