Multimedia Forensics

Slack space allows a nearly omnipresent and easily abused area for concealing data. There are several types of slack space and slack space is affected by file system specifics. As such, slack space is easily abused in the FAT32, NTFS, and Ext3 file systems. Additionally, many results of a slack space experiments performed on both the NTFS and Ext3 file systems clearly show that there ant many ways to conceal data. Some data concealing methods are limited to a particular file system, such as Alternate Data Streams (a capability that some system administrators, especially those who carry the responsibility of keeping their computers protected against intruders, may reasonably label a nuisance). The origin of this functionality is closely related to file system development and examples of covering data and executing programs from within an Alternate Data Stream are known from the first file systems. Other methods concerning data concealment are known as well. For example, disguising files, making use of hidden attributes, and using deletion to hide data. The importance of these techniques are always seen from the forensics examiner’s point of view.

It is likely that most paranoid computer users have at least heard rumors concerning the disposition of their deleted data. However, it is just as unlikely that the majority of computer users (including professionals) understand the real, true story that takes place behind the scenes of a delete button click. By itself, that makes data deletion an fascinating subject and one that requires an explanation as to what has caused the persistence of this problematic area of computing. Once again, differences can be found between the FAT32, NTFS, and Ext3 file systems concerning their deletion mechanisms. The concept of disk wiping and deletion should be clearly understood before proceeding to platform specific tools for both the Windows and Linux operating systems. Relevance for the forensics examiner is, once again, essential and special attention shold be given to the topic of drive slack space.

Hard disk data recovery is normally possible because of the nature of digital data. Complete data removal may very well be impossible without physically destroying the disk platter(s) on which it was originally written. The question of true deletion along with the recoverability controversy, reasons why deletion is such a difficult beast to tame, and low-level details concerning disk coding and channel information (useful in gaining a more complete understanding of the problem space) are then covered. The effectiveness of potential destruction methods (e.g. breaking a disk platter into pieces with a hammer and subjecting a hard drive to a degausser) should also be considered. Finally, legal requirements and government standards must be taken into account.

The forensics examiner’s ability to retrieve secret and erased data is very important. As a counterpoint to the methods used to hide data, methods that can be utilized to discover and reclaim data should be learned by trial and error principle. The most popular digital data recovery software (by the number of references and recommendations) for both the Windows and Linux platforms can easily be found on the web. Potential users should compare capabilities, file systems support, and take into account other relevant, potential decision making, considerations. Where data recovery software is unable to extract erased data, radical and/or exotic techniques can be employed. The use of such tools would most likely only be considered in cases of extraordinary importance, but they offer a glimpse into the reality that nearly everything you do on a computer leaves traces.

Grab realistic info in the sphere of traffic to website – please make sure to study the site. The time has come when proper info is truly only one click of your mouse, use this chance.

A good forensics inspector should be aware of the techniques that an attacker, intruder, malicious program, computer virus, or worm is capable of utilizing. Indeed, a significant body of knowledge will be required to track down the steps taken by an adversary, piece together the puzzle of events, and successfully defend conclusions in a court of law. While not every incident investigated will be found to have been carried out by someone with the skill of an expert hacker, automatic tools are becoming more intelligent on a daily basis and can give even a script kiddie power and capabilities that previously did not exist.

During the commission of a crime it is quite natural, and a common human trait, to attempt to cover up, mask, or otherwise hide evidence of prohibited activity. In some cases, concealing data is part of the master plan and helps ensure the success rate of the illicit activities. Erasing data from a hard disk can be used as a concealing technique as well as an attempt to hide evidence.

To be successful, forensics detectives must know and understand these methods. Additionally, they must have the ability to retrieve as much case related data as possible; finding and recovering hidden and edited data. The focal points of forensic hard drive data recovery include: physical properties of a hard drive; distinguishing attributes for the FAT, NTFS, and Ext3 file systems; techniques used to both hide and find digital data; software tools available for deleting and recovering data; true data deletion; applicable regulations regarding data destruction; and digital data recovery capabilities. The subject areas are intended to provide background to the neophyte forensics practitioner or those with an interest in the field.

To understand how differences in file systems influence hard disk data concealing, erasing, and recovery, an overview of the physical characteristics of a hard disk is required. Particularly important is the use of magnetization, the composition of the materials used on modern disk platters, and disk layout as it relates to the organization of tracks and sectors. Disk formatting as well as the mechanism used to read and write data to the media is also meaningful background information. These data points will all be mandatory to fully grasp concepts and techniques used during investigations that a forensics inspector may be called upon to perform.

While areas of commonality exist between hiding and recovering data, individual file systems have specialties that affect operating system and application behaviors. These differences bring about variances in attainable results both for the miscreant and the examiner. Most recovery experts focus on the FAT, NTFS, and Ext2fs file systems (arguably the most common file systems in use today) as they relate to concealing, erasing, and recovering data. File system specifics and their structures will be used to provide additional background information as well as assistance in the complete understanding of the subject area.

Check out pragmatic info in the sphere of Free Traffic System – make sure to go through the page. The times have come when concise information is really at your fingertips, use this opportunity.