±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 35514
New Yesterday: 4 Visitors: 162

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Independent Forensics Review in CP case

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 

Senior Member

Re: Independent Forensics Review in CP case

Post Posted: Jan 31, 19 15:49

- pbobby

An example I worked recently:

1. 250Gig SSD, user deletes approx 30Gig of data.
2. User powers down the computer following that operation.
3. I image the drive.
4. Much of the deleted data was part of that image because it takes actual time to clean up that much data.
5. 2 weeks later another analyst wanted to image the drive, no deleted content was available on the SSD because the garbage collection had finally completed (30gigs is a lot of garbage collection).

Do you mean that in the two weeks between 4 and 5 the garbage collection completed? (presumably with the SSD not powered Shocked ) or that it happened during 5?

- In theory there is no difference between theory and practice, but in practice there is. - 

Page 2 of 2
Page Previous  1, 2