I backed up the disk image file as a baseline, then I deleted all the images and made another disk image file for testing.
#PRODISCOVER BASIC DOWNLOAD FULL#
Finally, I deleted all the even-numbered images and copied the drive full of images. Then I deleted all the odd-numbered files and copied it full of images. I used a tool to fill a thumb drive with empty 4K-sized files numbered sequentially. Emails flew back and forth a few times and I finally agreed to make a small test set to demonstrate what I'd determined to be the issue. With their test data, their software worked perfectly, but we couldn't find anything in our "real world" test data sets. We were evaluating a tool to recover deleted images once.
Read the FAQ before posting.Ĭreate cool test data? Take a look at some of the Open Source / commercial digital forensic tools and find ways to defeat them in the spirit to improve them. Irrelvant submissions will be pruned in an effort towards tidiness. Vote based on the quality of the content. Topics include digital forensics, incident response, malware analysis, and more. This subreddit is not limited to just the computers and encompasses all media that may also fall under digital forensics (e.g., cellphones, video, etc.). The field is the application of several information security principles and aims to provide for attribution and event reconstruction following forth from audit processes. A community dedicated towards the branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.