Most forensics imager tools do not really copy all sectors

Discussion in 'privacy technology' started by redcell, Dec 7, 2014.

  1. redcell

    redcell Registered Member

    Sep 27, 2010
    I encourage FDE enthusiasts to watch this video. It reminds us how crucial to have our system to be fully encrypted. In short,

    Forensic Imager Tools: You don't have the Evidence - Shmoocon 2014

    1. There are reallocated sectors happening during any imaging process. It means that (during imaging) a hard drive contents are being modified without them knowing or speaking about it.
    2. Most forensics do not really image out the hard drive 100%.