Data Carving Issues

Posted December 7th, 2006 by Chetan Gupta

by Chetan Gupta, NII Consulting

Many a times as an investigator, I have to deal with the issue of carving data from
unallocated spaces in a partition. There are many commercial data carving tools such as Encase, Winhex, Accessdata FTK, DataLifter, ILookInvestigator. Well, I have tried most of these and must say most of them have their share of pros and cons. Read the rest of this entry »

Filed under:Disk Forensics, Fundamentals, Tools

Bad Superblock, corrupt inode tables and loads of bad luck!

Posted December 7th, 2006 by Chetan Gupta

by Chetan Gupta, NII Consulting

Well, last week was abuzz with activity when we had to recover data from a corrupt Linux hard disk. Thought it would be pretty easy but as soon as I loaded the hard disk, I knew something was amiss. Read the rest of this entry »

Filed under:Case Studies, Disk Forensics, Fundamentals