F.L.A.M.E. - A new tool for data recovery

[irs]

The police and forensic experts should always work on a full copy through a write blocker like a tableau or on an image file and always compare hashing value with the original one ...
As I know changing LBA content is forbidden, skipping sectors filling with defined pattern on the copy and hashing declaring skipped sectors MAY be allowed.

 

[Jared]

I think this is one that will vary by country. Here I think standard practice is that the MD5 hash of the copy needs to match the original (which generally is expected to be write blocked). So changing any bits would throw that off. However if you did the AA BB adjustment while working and then set it back when finished, I suppose it'd still check out then.

 

[lcoughey]

I've always made at least 3 copies of a drive for forensics:

1. Exact clone with MD5 - stored in safe with original
2. Exact clone - no need for MD5, this drive is to play with, without having to worry about date and time stamps
3. Exact image file with MD5 - this is the working file that would be passed around between investigators and examined with enCase or other forensic software programs

 

[Jared]

Yep, the three clones process is standard practice here too.

 

[Jared]

Well it's been several months now, and despite the promises to Recovery Force and Data Medics we have yet to receive our beta test F.L.A.M.E. systems.

Isn't building much confidence. If IRS says the tool is legit I have to believe him, but I certainly have my doubts about what kind of company they are and how their support and updates will be.

 

[abedalkareem]

the screen shots is unavailable !!

 

[Jared]

Yes, I'm not sure what happened exactly. Something got messed up on the forum and during the repair process some older threads lost all pictures. I'll have to see if the files still exist somewhere on the server.