Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

To: MortMan
You can’t recover deleted files from the image - only from the drive itself (unless a program such as bleach bit is used to santize the actual magnetic cells).

Sure you can. Dump the image to a working copy, mount it, and you can do anything you want to to it. You'll still have an archival copy of the image to refer back to as well. This is standard procedure when doing computer forensics. It is not rocket science.

13 posted on 12/15/2020 10:39:40 AM PST by zeugma (Stop deluding yourself that America is still a free country.)
[ Post Reply | Private Reply | To 8 | View Replies ]


To: zeugma

I would say it depends on whether the image is a hardware or software image. If software, the registry - the list of segments occupied by actively referenced file pieces - would only reflect the content of the registry, as opposed to the hardware itself, which will have all of the software-recognized files, plus segments of or complete files which have been deleted from the registry.

Hardware imaging software replicates every memory location on the device. Software imaging only replicates those files recognizable from the registry.

The problem lies not in the manipulation of the image, but rather in the manner in which the image is produced.


14 posted on 12/15/2020 10:45:13 AM PST by MortMan (Shouldn't "palindrome" read the same forward and backward?)
[ Post Reply | Private Reply | To 13 | View Replies ]

Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson