Good forensic practice

There are many areas of forensic investigation that do require considerable care. If a good working disk is being investigated there will be many standards to follow. CnW Recovery concentrates on disks that have failed, either logically or physically. The following suggestions may assist in producing a valid report that could stand up in court. CnW Recovery does not claim full knowledge of court procedures so this is just advice given in good faith.

Security of data

Many disk recovery routines can be run by placing the disk in a USB caddy and reading it. For most non critical jobs this is fine but one must always be aware that when a PC recognises a disk, it will often write a file, or modify a file. It is possible that a critical sector could be overwritten or modfied. The only solution to this potential problem is a physical write protect device. These do exist for standard drives and will prevent any changing of the disk contents.

Another solution to this problem is to use a hardware disk duplicator. This will preserve the original disk, but there is still the danger that the clone disk will be modified when the PC mounts it.

The first stage of any investigation is to make a known good copy of the drive. For a working disk this is OK, but for a partially failed disk it is harder to make a copy that is known to be good and will stand up in court.