Collaborate Disseminate
I am looking into M.2 docking stations such as the Maiwo K3016S as shown below.
Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order to make forensic images of (Bitlocker en… Continue reading Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?
I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I’d like to startup using an bootable USB stick with OSFClone and image the disk to an external disk. The laptops (HP ProBooks) in thi… Continue reading Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?
I created a hidden volume in Veracrypt. I didn’t select the option for my volume to be write-protected but when I try to copy files to the volume, I get a message "saying this disk is write-protected." How do I fix this?
Continue reading Veracrypt message "write protected volume" [migrated]
In preparing exercises for a class on Digital Forensics, I am having trouble finding disk and memory images that are up-to-date. It seems like there was a lot of activity through 2010 or 2012, but there are only a few files since then. It… Continue reading Site with recent forensic images for experimentation and teaching? [closed]
I want to sell my old 4TB Hard Drive.
Of course I want no one to steal my data.
Overwriting the whole drive with zeros with dd if=/dev/zero of=/dev/sda would take about 18h.
But I cannot reboot my PC for 18 hours because I think dd always … Continue reading Wiping a hard large hard drive efficiently but securely step by step
I have a hard drive used for years, there are windows and many personal files on it. What I called "files" are images, musics, documents (pdf or docx), but not programs. All the "files" were not initially infected. As I… Continue reading Is it safe to extract file from potentially infected disk
I use dd to “burn” an ISO file to USB stick:
dd bs=4M if=/mnt/media/ISO/Fedora-Workstation-Live-x86_64-31-1.9.iso of=/dev/sdd conv=fdatasync status=progress
Now I can see several partitions has been created:
I need to forensically image a Samsung phone that is not rooted or running a custom recovery mode. I have not been able to pull an image using ADB, as the default Samsung recovery mode only allows ADB to push updates to the p… Continue reading Is it possible to obtain a forensic image of an Android device without installation of custom recovery mode or rooting?
How do I find an image with an URL ih3googleusercontent?
I have already tried searching it online thus it is not on my google drive account. How can I find the picture?
If a user on normal everyday-use computer wiped the unallocated space on a hard disk drive, how long would it take before analysis of the unallocated space would yield no evidence of a disk wipe? Lets say that there is 100 MB… Continue reading How long would traces of a disk wipe be visible? [on hold]