The forensic examination of a hard drive is a structured process for securing, analyzing, and evaluating digital traces on a data storage medium. Unlike a normal file search, a hard drive is ideally not used directly as a working medium. First, the technical condition of the data storage medium is assessed, a suitable backup method is determined, and a minimally invasive basis for investigation is established.

A hard drive can contain far more information than the files a user sees in Explorer or Finder. Depending on the file system and the condition of the disk, additionally deleted files, file system structures, unallocated space, metadata, previous partitions, and other technical artifacts may be relevant.

The examination of a hard drive is therefore a classic area of ​​IT forensics . Its goal is not to read as many files as possible, but to methodically secure a defined dataset and then evaluate those traces that are relevant to the specific question being asked.

What does forensic examination of a hard drive mean?

A forensic hard drive examination involves the controlled collection and analysis of data from a storage medium.

This allows for an examination of which files are present, which files have been deleted, which directories have been used, which file system information exists, and whether previous activities can be reconstructed using technical traces.

This examination differs significantly from a normal data recovery or a review of existing files.

While a simple file search primarily considers the currently visible content, forensics also takes into account the structures of the data carrier itself.

Which hard drives can be forensically examined?

In principle, various magnetic hard drives can be examined. These include internal HDDs from desktop PCs and notebooks, as well as external USB hard drives and other magnetic mass storage devices.

Which method is technically suitable depends, among other things, on the interface, storage capacity, state, file system and possible encryption.

An intact SATA hard drive presents a different starting point than a data carrier with severe read errors or mechanical damage.

Why not simply connect the hard drive to a normal PC?

A normal operating system can cause changes simply by connecting a storage device.

File systems can be mounted, index information updated, or other administrative data written. While such changes may be minor, they are unnecessary in the case of potential evidence.

Therefore, in appropriate investigations, attempts are made to prevent write access to the original.

What role does a write blocker play?

A write blocker is placed between the original data carrier and the computer being examined. It is designed to allow read access but block write commands to the original.

This reduces the risk of the investigation system unintentionally altering the source data carrier.

Depending on the interface, different hardware solutions exist for SATA, SAS, USB or other data storage devices.

However, using a write blocker does not replace documenting the entire backup process.

What happens before the actual backup?

Before starting, the data carrier is identified as uniquely as possible.

This can include documentation of the manufacturer, model, serial number, storage capacity and connection type.

The external condition can also be relevant. Damage, unusual noises, or other peculiarities should be taken into account before prolonged use.

A potentially unstable storage medium may require a different approach than a technically sound hard drive.

Why is the serial number important?

Investigations may contain several identical data carriers.

A unique serial number helps to unambiguously assign the subsequent image to the original data carrier.

This assignment is particularly important when examining multiple hard drives from a computer, server, or company.

What is a forensic backup of a hard drive?

A forensic backup attempts to capture a defined set of data from the hard drive in a controlled manner.

With traditional HDDs, this can be a sector-by-sector or block-by-block backup of the logically addressable memory.

This not only copies active files, but also allows storage areas that are not currently assigned to any file to be included in the created image.

The basics of this procedure are explained in detail in the article "What is forensic data backup?" .

What is a bitwise copy of a hard drive?

The term bitwise copy, in simplified terms, describes the most complete possible capture of the memory addressable at the selected level.

Technically, the reading process is usually performed block- or sector-wise.

The advantage over a normal file copy is that areas can also be captured which the file system does not currently assign to any visible file.

The technical differences are discussed in more detail in the previously published article "Bitwise Copying in IT Forensics".

What is a forensic image?

The extracted data is often stored in an image file.

This image then forms the basis for the analysis. The original should be kept out of the further investigation process as much as possible.

Depending on the software used, different image formats can be employed.

The essential point is not just the file format, but that it remains clearly documented which data carrier the backup comes from and which data area it contains.

Why is the examination preferably not carried out directly on the original.

Any direct access to the original increases the risk of alteration.

Investigation software can also write data if a data carrier is not mounted with sufficient protection.

In contrast, a previously created backup allows for repeated analyses without having to reuse the original data carrier for each step.

What is a working copy?

In certain workflows, the primary forensic image remains archived unchanged as a reference.

An additional working copy is used for the analysis.

Should this working copy be damaged or accidentally altered, a new working basis can be created from the unchanged reference backup.

How is the integrity of the backup checked?

Cryptographic hash values ​​can be used for integrity control.

A mathematical test value is calculated from a defined data set.

If the same data set is hashed again later and the same value is produced, this strongly suggests that the hashed data has not changed.

For modern investigations, SHA-256, for example, can be used.

The functionality is explained in the technical article "Hash value in digital forensics".

Does a hash value prove the completeness of the backup?

No.

A hash value can verify the integrity of the actually captured data. However, it does not automatically prove that every theoretically existing or accessible area of ​​the original data carrier has been successfully read.

If there were any reading errors, these must be documented separately.

What happens in the case of reading errors?

A damaged or aging hard drive may contain sectors that can no longer be reliably read.

Professional imaging software can detect and log such errors.

Depending on the situation, one can try to read problematic areas several times or skip them initially.

However, with physically unstable hard drives, careful consideration must be given to the situation, as repeated read attempts can further worsen the condition.

When should a hard drive no longer be read normally?

Unusual mechanical noises, frequent connection interruptions, significant speed losses, or numerous read errors may indicate a physical defect.

In such a situation, specialized data recovery may be necessary.

The initial goal is then to secure as much accessible data as possible before the actual forensic analysis begins.

What is the difference between hard drive forensics and data recovery?

Data recovery focuses on retrieving lost or damaged data.

Hard drive forensics raises additional questions.

For example, it examines when a file existed, whether it has been deleted, what file system traces are present, whether it belongs to a specific user context, and what other technical information is associated with it.

Therefore, in forensic science, a recovered file can only be one part of the overall findings.

Which file systems can be examined?

The possibilities depend on the respective operating system and storage medium.

NTFS is particularly common on Windows systems. FAT and exFAT file systems are also used.

Other systems can use, for example, ext file systems, HFS+ or APFS.

Each file system has its own structures and metadata, which are evaluated differently forensically.

Why is the file system so important?

A file system organizes which storage areas belong to which files.

It manages file names, directories, size information, timestamps, and other metadata.

Therefore, a forensic analysis does not only consider the content of individual files.

The administrative structures of the file system can also contain important information about past activities.

What is the significance of NTFS?

NTFS is the standard file system of many Windows systems and creates numerous forensically relevant structures.

The Master File Table, or MFT for short, is particularly important.

It contains records of files and directories and can therefore be of great importance for the reconstruction of file system activities.

What is the Master File Table?

The Master File Table is a central structure of the NTFS file system.

For files and directories, data records are managed there that can contain, among other things, names, time information, sizes and other attributes.

Even after a file has been deleted, certain MFT information may still be present as long as the data record in question has not been used again.

Can the MFT show deleted files?

Yes, under certain conditions.

If a file is deleted, its previous MFT entry may still be retained.

This may allow the reconstruction of filename, time information and other metadata, even if the actual file content is no longer fully available.

However, the existence of an MFT entry does not automatically mean that the file can be fully recovered.

What is Unallocated Space?

Unallocated space refers to memory areas that are not currently assigned to any active file.

On a traditional hard drive, the contents of deleted files may still be present.

Although the file system considers the storage space to be free, the original data is not necessarily overwritten immediately.

A sector-by-sector backup can capture this area and make it available for later analysis.

Why is unallocated space of forensic interest?

A normal file copy contains only the currently visible files.

Deleted file contents in unallocated space would be lost as a result.

A forensic image, on the other hand, can preserve these areas.

This makes it possible to reconstruct deleted files or data fragments later.

What is File Slack?

Files occupy storage space in defined allocation units.

If a file does not completely fill the last memory area allocated to it, an unused remainder may result.

This area is often referred to as slack space.

Depending on the file system and previous storage usage, data remnants may be present.

What is file carving?

File carving is a method for reconstructing files based on characteristic file structures or signatures.

This does not necessarily rely on existing file system entries.

This method can therefore be particularly interesting in unallocated memory areas.

A problem arises with fragmented files whose components were not saved immediately one after the other.

Can File Carving recover any deleted file?

No.

If relevant memory areas have been overwritten, the original data will be missing.

Even highly fragmented files can be difficult or even impossible to fully reconstruct.

Carved files also often lack their original filenames and directory paths.

Can deleted files from a hard drive be recovered?

Under favorable conditions, yes.

With a magnetic hard drive, the data of a deleted file is often not immediately physically removed.

The file system initially marks the storage area as free.

As long as it has not been overwritten with new data, data remnants may still be present.

Why shouldn't a computer be used after important data has been deleted?

Each subsequent write operation may overwrite previously released memory areas.

Even normal system activities constantly generate new data.

The longer a computer continues to operate after data deletion, the greater the risk that relevant memory areas will be overwritten.

Can overwritten files be recovered?

If the relevant storage areas have indeed been overwritten with new data, the previous data cannot simply be recovered using normal forensic procedures.

The widespread notion that modern forensics can reconstruct hard drive data that has been overwritten any number of times is unrealistic.

The crucial question is therefore whether the original data area still exists.

Is it possible to determine when a file was deleted?

That depends on the file system and the existing artifacts.

Certain structures can provide clues about the deletion process or the time period.

However, a clear deletion timestamp is not available in every situation.

For a reliable temporal reconstruction, it is often necessary to compare several artifacts with each other.

Can file timestamps be examined?

Yes.

File systems store different timestamps, for example, for the creation or modification of a file.

However, these values ​​must be interpreted correctly from a technical perspective.

Copying, moving, restoring, or certain programs can affect individual timestamps.

Can manipulated timestamps be detected?

Under certain conditions, discrepancies between different pieces of time information may become apparent.

For example, a file may have internal metadata that does not match its file system timestamps.

Other operating system artifacts can also provide additional time information.

However, a single unusual timestamp is not conclusive proof of manipulation.

Can the filenames of deleted files be recovered?

Yes, under certain conditions.

File system structures may still contain references to previous file names, even though the actual file content is partially or completely lost.

For example, remaining MFT entries can be relevant in NTFS.

Can previous directory structures be reconstructed?

This may also be partially possible.

If the relevant file system information is still available, previous paths or folder assignments can be reconstructed.

However, the more the data carrier was reused after deletion, the greater the probability that corresponding structures were overwritten.

Can deleted partitions be examined?

Yes.

If only the partition table has been changed or a partition deleted, the data it contains does not necessarily disappear immediately.

Under suitable conditions, previous file system structures may still be present and reconstructible.

That depends on what changes were subsequently made to the data carrier.

What is a partition table?

The partition table describes the logical division of a data carrier into different areas.

Modern systems often use GPT, older systems may use MBR.

A damaged or deleted partition table does not necessarily mean that all the contents of the partition have been overwritten.

Can a formatted hard drive be forensically examined?

Yes.

However, success depends heavily on the type of formatting performed and what happened to the data carrier afterwards.

Certain formatting processes may allow older file system structures and data areas to be partially preserved.

Other processes can overwrite significantly more data.

What is the difference between quick formatting and full formatting?

A quick format typically recreates essential file system structures without necessarily overwriting every user data area completely.

This means that some previous data may still be present in memory.

Depending on the operating system and method, a full format can perform significantly more extensive write or check operations.

Therefore, for a forensic evaluation, it is necessary to know which specific procedure was used.

Can data be recovered after a fresh Windows installation?

Partially.

A fresh installation writes new operating system files to the storage medium and may overwrite older storage areas in the process.

However, other areas may contain earlier data.

The chances of success depend significantly on how extensive the new installation was and how intensively the system was subsequently used.

What should be considered when using encrypted hard drives?

For example, a hard drive can be protected with BitLocker or another encryption method.

A sector-by-sector image may still be technically possible, but it may then only contain encrypted data.

The analysis requires the appropriate keys or access data.

The system state before the backup can therefore be crucial.

Can a BitLocker hard drive be forensically examined?

Yes, provided suitable access options are available.

If the recovery key or another decryption method is available, the content can be analyzed.

If a computer has already started and the volume is unlocked, this state can also be relevant for the backup strategy.

Why can turning off an encrypted computer be problematic?

A running computer can provide a volume that has already been decrypted.

After switching off the device, only the encrypted data carrier may remain.

If a suitable key is not available, previously existing access may be lost.

Therefore, one should not act reflexively when a computer for evidence is switched on.

What is an HPA?

Host Protected Area refers to an area of ​​a hard drive that can be hidden from the normal operating system via certain ATA functions.

Such areas can be used for specific technical purposes.

A particularly in-depth investigation can therefore examine whether the reported and the actually addressable capacity differ from each other.

What is a DCO?

Device Configuration Overlay is another ATA function that allows you to influence the visible properties or capacity of a storage device.

Such specialized areas do not always play a role in normal investigations, but can become relevant in certain cases.

Why is the hard drive size displayed in the operating system not always sufficient?

The operating system normally displays the logically available memory.

Partitioning, hidden areas, and certain controller functions may cause this display to not reflect all the technical details of the disk.

A forensic analysis can therefore take additional device information into account.

Can a hard drive contain malware?

Yes.

Malware can exist as a file, script, executable program, or as part of compromised applications.

A hard drive analysis can therefore also be relevant in the event of security incidents.

However, the mere discovery of a file does not prove that malware was actually executed.

Is it possible to determine whether a program has been executed?

Under certain conditions, operating system and application artifacts can provide clues.

For example, different system structures may be relevant for such an evaluation on a Windows data carrier.

The exact statement depends on the available data.

Can user activity on a hard drive be reconstructed?

Yes, partly.

User activity can leave traces in file systems, registry data, browser data, application files, event logs, and other system artifacts.

However, a hard drive does not contain an automatic, complete video recording of all user actions.

The reconstruction is based on the actual existing technical traces.

Can connected USB devices be detected using a hard drive?

On Windows systems, information about previously connected USB devices may be stored on the system disk.

Under certain conditions, this makes it possible to determine which devices were connected to the computer.

The exact statement depends on the Windows artifacts obtained.

Can file copy operations be reconstructed?

Manchmal

An operating system does not necessarily keep a complete log of every file that has been copied.

However, several artifacts can collectively support a possible copying process.

This can include file timestamps, USB traces, recently used files, target media, and other information.

Is it possible to determine if data has been copied to a USB stick?

Under suitable conditions, technical evidence can support such a process.

An investigation can be particularly informative if both the computer and the USB storage device in question are available.

Then files, hash values, metadata, and time information can be compared.

Can identical files be detected on two storage devices?

Yes.

Hash values ​​can be used to determine whether two files contain the same content.

If two files have the same SHA-256 value, this strongly suggests that the hashed contents are identical.

However, the hash value does not automatically prove which storage medium was the source or when a copying operation took place.

Can the origin of a file be determined from its hard drive?

Sometimes technical artifacts can provide clues about the origin.

This can include, for example, download information, email data, cloud traces, file metadata, or system artifacts.

However, a clear origin cannot be reconstructed from every file.

Can browser data be examined on a hard drive?

Yes.

Depending on the program, browsers store information such as history, downloads, cache, cookies and other data locally on the hard drive.

Even deleted browser data may still be partially present in databases or other storage areas under certain circumstances.

Can emails be found on a hard drive?

Yes, if an email program has stored local data or if emails are otherwise located on the computer.

Depending on the program, complete mailbox files, individual messages, attachments, cache data, or configuration information may be present.

However, with purely cloud-based services, the amount of locally available data can be significantly smaller.

Can cloud services be examined using a hard drive?

Cloud synchronization programs can leave behind local directories, databases, logs, and configuration files.

This means that activities such as OneDrive, Dropbox, or Google Drive can leave technical traces on the computer.

However, the local hard drive does not automatically contain the complete cloud data set.

Is it possible to determine whether a file has been downloaded?

Yes, under suitable conditions.

Browser data, file system information, zone identifiers, or other system artifacts can provide clues about a download.

The information available depends on the operating system, browser, and specific download method.

Is it possible to determine when a file was last used?

Depending on the operating system and application, several artifacts can provide clues about usage.

A single timestamp should not automatically be equated with the actual opening time.

To obtain a more reliable assessment, several data sources are compared.

What is a timeline analysis?

In a timeline analysis, time information from various forensic data sources is combined.

This allows a sequence of events to be reconstructed.

For example, file creation, user login, connection of a USB device and subsequent file deletion can be compared over time.

Such a correlation is often more meaningful than considering individual timestamps in isolation.

Why are different forensic programs used?

Forensic software interprets file systems, databases, and other structures using its own parsers.

No tool is automatically superior in every situation.

Particularly important findings can therefore be verified with a second program or by directly checking the underlying data.

What does cross-tool validation mean?

Cross-tool validation means verifying a relevant finding with a second independent tool or procedure.

This reduces the risk of an error by a single parser going unnoticed.

This additional check can be particularly useful in cases where the evidence is critical.

How long does a forensic examination of a hard drive take?

It is not possible to reliably specify a general duration.

Even the backup process depends on the capacity, speed, interface, and condition of the data carrier.

The analysis can then take significantly more time than the acquisition itself.

A 4TB storage device with millions of files and complex issues is not comparable to a small hard drive.

Why isn't a large hard drive automatically more complex than a small one?

Storage capacity is only one factor.

A small hard drive with a damaged file system, numerous user profiles, and complex databases can be considerably more resource-intensive than a larger, clearly structured storage device.

The research question has a significant impact on the effort required.

How much does a forensic hard drive examination cost?

The costs depend on the scope of the order.

Relevant factors include data carrier size, condition, encryption, number of data sources to be examined, and the specific question being asked.

A simple backup differs significantly in effort from a comprehensive reconstruction of user activity or deleted files.

When is a forensic hard drive examination useful?

It can be particularly useful when digital processes need to be tracked on a computer.

Typical issues include data deletion, data copying, data theft, suspected manipulation, unauthorized access, malware, use of external storage media, or recovery of important files.

Hard drives can also contain important digital evidence in matters relating to labor law, civil law, or criminal law.

What should be avoided before a forensic examination?

A relevant computer or data storage device should not be used unnecessarily if possible.

In particular, no data recovery programs should be installed on the affected storage medium.

Defragmentation, reinstallation, formatting, or intensive normal use can also overwrite existing data.

If the data could be relevant as evidence, a suitable backup strategy should first be determined.

Why shouldn't data recovery software be installed on the original device?

The installation process creates new files and performs write operations.

This can overwrite storage areas that still contain fragments of deleted data.

Therefore, a professional recovery is preferably performed using a previously created backup.

Why shouldn't a hard drive be defragmented?

Defragmentation involves moving large amounts of data within the hard drive.

Previously free memory areas may be overwritten.

This can be significantly detrimental to the recovery of deleted data.

Practical example: Deleted company files

A company discovers that a directory containing important project files has been deleted.

The computer in question contains a classic HDD and has seen little use since the data was erased.

Instead of installing recovery software directly on the computer, the data carrier is first backed up in a controlled manner.

Next, file system structures, MFT entries, and unallocated memory areas are examined.

Depending on the condition, files may be fully recovered, only detectable as previous file entries, or no longer reconstructible.

Practical example: Suspected data copying

Before an employee leaves the company, there is a suspicion that confidential files were copied to an external data storage device.

The company computer's hard drive is being forensically secured.

Then, USB artifacts, file system traces, and activities within the relevant time period are compared.

If the external storage device presumably used is also available, identical files and hash values ​​can be compared.

Only the totality of the evidence allows for a more reliable assessment.

Practical example: Formatted hard drive

A hard drive was accidentally formatted.

The chances of success depend on the formatting used and how much data was subsequently written to the storage medium.

A forensic backup initially preserves the current state.

It can then be checked whether previous file system structures or user data are still present.

Practical example: defective hard drive

An HDD is only recognized sporadically and is making unusual noises.

In this state, it would be risky to run extensive normal analysis programs directly on the original.

First, it must be assessed whether gentle data acquisition is still possible or whether specialized data recovery is required.

The goal is to place as little additional strain on the data storage medium as possible.

FAQ on the forensic examination of a hard drive

What is a forensic hard drive examination?

It is the controlled backup and analysis of digital traces on a hard drive. In addition to visible files, deleted data, file system information, and other technical artifacts can also be examined.

Is the original hard drive being examined directly?

If technically feasible, a forensic backup is created first, and the analysis is then carried out on this data basis or a working copy.

Why is a write blocker used?

It is designed to prevent the investigation system from unintentionally writing data to the original hard drive.

What is a bitwise copy?

In simplified terms, it refers to the most complete possible sector- or block-wise recording of the logically addressable memory area.

What is a forensic image?

A forensic image is the stored representation of the secured data carrier or a defined data area.

Why are hash values ​​calculated?

Hash values ​​allow you to check whether a defined data set has changed since a documented reference point.

Can a deleted file on a hard drive be recovered?

Yes, under certain conditions. The crucial factor is whether the original memory areas are still present or have already been overwritten.

Can a permanently overwritten file be recovered?

If the relevant storage areas have indeed been overwritten with new data, the previous data cannot simply be reconstructed using normal forensic methods.

Is it possible to determine when a file was deleted?

Under certain conditions, file system and other artifacts can provide clues about the deletion period. However, an exact deletion time is not always available.

Can filenames of deleted files be recovered?

In some cases, file system structures may still contain earlier names, even if the file content is no longer fully present.

Can deleted folders be recovered?

Under suitable conditions, previous directory structures can be partially restored or reconstructed.

What is Unallocated Space?

This is storage space that is not currently allocated to any active file. On a hard drive, remnants of deleted files may still be present there.

What is file carving?

File carving attempts to reconstruct files from a data stream or free memory areas based on characteristic structures.

Can File Carving recover any file?

No. Overwriting, fragmentation, and missing file structures can prevent a complete reconstruction.

Can a formatted hard drive be examined?

Yes. The chances of success depend on the type of formatting and the subsequent writing processes.

Can a deleted partition be recovered?

Under certain conditions, previous partitions and file system structures may still be present and can be reconstructed.

Can a BitLocker hard drive be examined?

Yes, provided that suitable keys or other means of accessing the encrypted data are available.

Can a damaged hard drive be forensically examined?

Partially. In the case of physical damage, specialized data recovery may be necessary first to secure the still accessible data.

Should I continue using a hard drive that makes clicking noises?

No. Unusual mechanical noises can indicate a physical defect. Continued use can worsen the damage.

Should I install data recovery software for deleted files?

Not on the affected storage medium. The installation itself may overwrite any existing deleted data.

Should a hard drive be defragmented before examination?

No. Defragmentation causes extensive write operations and can overwrite deleted data areas.

Can USB traces be found on a hard drive?

On Windows systems, various pieces of information about connected USB devices can be stored on the system disk.

Is it possible to determine which files were copied to a USB stick?

Under suitable conditions, several artifacts can support such a process. However, a complete automatic copy history does not exist.

Can browser data be examined on a hard drive?

Yes. History, downloads, cache, cookies and other browser artifacts can be analyzed depending on the software and data state.

Can deleted browser data be recovered?

Some database remnants, cache files, or other traces may remain. A complete recovery is not guaranteed.

Can emails on a hard drive be examined?

Yes, provided that local mail data, attachments, cached data or other relevant information has been stored.

Is it possible to determine whether a file was downloaded from the internet?

Depending on the system, browser information, file metadata, and other artifacts can provide clues about a download.

Is it possible to determine whether a file originates from the cloud?

Sometimes cloud client data, synchronization information, and other artifacts can provide relevant clues. However, a definitive origin cannot always be determined.

Can manipulated timestamps be detected?

Under certain conditions, discrepancies between different time information and other artifacts may become apparent. However, a single differing value is not automatic proof of manipulation.

How long does it take to back up a hard drive?

The duration depends on storage capacity, speed, interface, and the condition of the hard drive. Read errors can significantly extend the process.

How long does the entire examination take?

The analysis can take significantly longer than the backup process itself. The amount of data, the number of files, and the specific question being investigated determine the actual effort required.

Can a hard drive analysis be used in court?

Forensic evidence can be relevant in legal proceedings. Its specific significance depends on the method used for securing the evidence, its documentation, its technical validity, and its legal assessment.

What is the difference between hard drive forensics and data recovery?

Data recovery focuses on retrieving information. Hard drive forensics additionally examines the origin, time references, file system traces, user activity, and other technical factors.

Can hard drive forensics prove who deleted a file?

Not automatically. Technical traces can be associated with a user account or system state. Further information may be required for a definitive association with a natural person.

Can hard drive forensics prove that data has been stolen?

It can investigate technical traces of a potential data leak. However, conclusive evidence regularly requires the correlation of multiple data sources and cannot be derived solely from a single artifact.

Why a forensic hard drive examination is more than data recovery

A hard drive contains more than just files. It contains a file system, historical traces, metadata, deleted records, and a wealth of information about how a computer has been used.

The real forensic achievement, therefore, does not consist of recovering as much data as possible. The crucial factor is to systematically secure the original state and then technically classify the traces relevant to the question at hand.

For example, a recovered document does not automatically prove when it was deleted. A USB artifact does not automatically prove file theft. An identical hash value of two files proves the same file content, but not automatically the direction of a copy operation.

Professional hard disk forensics therefore combines backup, file system analysis, recovery, timeline analysis and the correlation of various artifacts.

It is precisely this connection that makes it possible to reconstruct a comprehensible set of facts from a large amount of individual technical information, without claiming more than the existing digital traces actually prove.

Back to knowledge overview