With a forensic investigation of a disk there are several very important points to note. These include

• Original data must not be changed in anyway
• Full details of all files to be obtained - dates etc
• Full details of history of disk - last written to, how many sessions on a DVD
• Logs of all operations and errors encountered
• Slack disk space recovery
• File signatures checking
• MD5 hash values for all files extracted

One very important on forensic recovery is that at times, file names are changed to disguise the file type. The CnW Recovery file signature routine will detect file types irrespective of how they have been named. We can therefore restore just the required file types.

The recovery logs will also indicate where data has been written to a disk so examiners can investigate files at a sector level if required. These can all be sorted, so that certain categories found easily, or they may be exported as comma delimited files for processing in standard database packages.

CnW Recovery Lewes  East Sussex UK