New answers tagged forensics
I'd like to refer to this video. It explains how data can be recovered from HDDs using thresholds. Which includes that the given signal-level returned from a HDD ain't only based on the current content, but also on what was previously there. By changing the 'accuracy' of the signal-detection you can find what was previously there. However this is of course ...
Its possible to recover data from SSD bare chips by fluctuating the power voltage very quickly while the array is being scanned- sometimes this works. I've also had some success reading totally dead-but-draw-voltage microSD cards by using a proprietry method involving low energy X-rays and modified readers, got about a 25-30% success rate this way. My ...
You can ro (read-only) mount removable drives. As to how you can set automount options is answered on another question.
Assuming you used a strong cryptography method, such as AES, there isn't a known better method. Brute force is the best (and only) option without the password. If you know part of it, you can set patterns in some cracking software to try specific combinations first, but there is no back door into them which is publicly known, and much investigation hasn't ...
All NAND flash needs to erase the block before writing it. But concerning security, you have to understand that you never know which block is written. SSD and also USB flash drives have internal controllers and remap the actual flash cells. Each flash cell only has a limited amount of writes before it fails. With the typical use of a USB flash drive or ssd ...
All modern NAND flash memory is written to in blocks. This is the same whether it is SSD or USB flash drives: NAND flash memory has a particular implementation that requires writing entire blocks. An erase block typically is a multiple of the read/write sector size.
Microsoft has a knowledge base article about this for debugging which will effectively provide the desired result. How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2 Forensics Wiki maintains a great list. Note that some tools only work for x86 so be sure x64 is also supported (i.e. FTK Imager).
Top 50 recent answers are included