Did you know that you can use DVR Examiner to create a forensically sound disk image?
When working a case, it is important to have a forensically sound copy of the original data as a backup if anything were to ever happen to the original data. This process helps protect the integrity of all evidence that might be brought to a trial.
To provide our users with the quickest and most efficient way to access the data they need, we have installed disk imaging directly in DVR Examiner to aid you in your investigation.
While other disk imaging programs can be time consuming, DVR Examiner can create a forensically sound disk image in just one simple step. Simply highlight the original hard drive from the list and select “Create a Forensic Image.” You will be prompted to select a destination and any hash options, before clicking “Create Image.” DVR Examiner can create a secure copy and a working copy in a different location, and will hash both the source and the destination files. To create a secure copy with other disk imaging programs, the user would have to either create an image and then copy that image, or create two separate images.
There is another crucial feature that users should know. This feature is the “stop on bad sectors” checkbox within the Disk Imaging function. We have this box checked by default; however, if you intend to walk away during the process, the image creation process stops. It is checked by default because we want to be sure that DVR Examiner doesn’t create an image by omitting bad sectors without authorization from the user. Depending on your investigation, it might be important to be familiar with the bad sectors so that you don’t miss out on crucial data.
DVR Examiner’s imaging program creates “DD,” or raw images, which are the ideal way to work with images in DVR Examiner. Not sure what a DD image is? Check out this blog post on the difference between E01 images and DD images and how they affect the speed with dealing with DVR data!
If you are still having difficulty understanding how Disk Imaging works on DVR Examiner, please feel free to reach out to us at support@dmeforensics.com, or calling us at (800) 413-0363, where a member of our support team would be happy to answer any of your questions.
3 comments