Guest Join UsHey Guest,
Welcome, Join Dolphin awesome community where you can discuss on various topics :-
You need to be Dolphin user to get one VIP forum account.
You can get latest software upgrade on DFL data recovery tools.
You can get latest data recovery manuals, case studies and tips.
You can seek professional data recovery support from worldwide engineers.
You can get firmware resources for all HDD brands.
You can get donor hdd support from all forum members.
Much More.. or Create an Account


New Data Recovery Adapters, HDD Head Replacement Tools, Unlock PCBs here
Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Forensic Images using DDP?
#1
Hi folks,
  Can we use this system to create Forensically Safe images?
We have been looking at Write Blockers but then I thought
that this brilliant piece of technology might be able to do
what we need.
  If not at this point could you, Stanley, apply a switch to
disable all writes to the drive?
  Forensic images must not change the original drive in any
way.
  FYI we have been looking at Forensic UltraDock 5.5
This meets the strict requirements for forensic analysis.

https://www.cru-inc.com/products/wiebete...v5-5/#info
Reply
#2
(10-15-2018, 12:49 PM)acrosstech Wrote: Hi folks,
  Can we use this system to create Forensically Safe images?
We have been looking at Write Blockers but then I thought
that this brilliant piece of technology might be able to do
what we need.
  If not at this point could you, Stanley, apply a switch to
disable all writes to the drive?
  Forensic images must not change the original drive in any
way.
  FYI we have been looking at Forensic UltraDock 5.5
This meets the strict requirements for forensic analysis.

https://www.cru-inc.com/products/wiebete...v5-5/#info

It shouldn't be too difficult to tell if it is forensically sound. Maybe try calculating a hash on the source pre and post image acquisition to see if there is any change. DDP does have a write-blocking checkbox from memory. I would enable this and see.
Reply
#3
Thank you.
I will see about the write blocking checkbox.
Obviously I missed it!

regards
Tony
Reply
#4
Hello Tony, after you tick the write blocking, it is fully read-only and won't do any write operations on the patient. The only missing part for forensic image is the real-time checking.
sales@dolphindatalab.com
Dolphin team
Reply
#5
(12-19-2018, 12:10 PM)Dolphin999 Wrote: Hello Tony, after you tick the write blocking, it is fully read-only and won't do any write operations on the patient. The only missing part for forensic image is the real-time checking.

Might pay to check the SMART on the drive before and after acquiring the image just to see if anything important changed during the acquisition i.e. if the drive condition degrades during the process.

Dolphin, does DDP have hashing capability for forensic images?
Reply
#6
Hash capabilities will be added to forensic addon. Smart parameters keep changing, the most important is hash checking, real-time checking for forensic image.
sales@dolphindatalab.com
Dolphin team
Reply


Forum Jump:


Users browsing this thread: 2 Guest(s)

About Dolphin Data Lab Forums

Dolphin support forum is for Dolphin users only to get latest software upgrade, new user manuals, case studies, data recovery solutions and tips on how to use Dolphin data recovery tools properly and for maximum data recovery.

For any more information, please contact us.

              Quick Links

              User Links