Most forensics imager tools do not really copy all sectors

Discussion in 'privacy technology' started by redcell, Dec 7, 2014.

  1. redcell

    redcell Registered Member

    Joined:
    Sep 27, 2010
    Posts:
    126
    I encourage FDE enthusiasts to watch this video. It reminds us how crucial to have our system to be fully encrypted. In short,

    Forensic Imager Tools: You don't have the Evidence - Shmoocon 2014
    https://www.youtube.com/watch?v=zYYCv21I-1I

    1. There are reallocated sectors happening during any imaging process. It means that (during imaging) a hard drive contents are being modified without them knowing or speaking about it.
    2. Most forensics do not really image out the hard drive 100%.
     
Loading...