All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Forensic-Trace feature of ReclaimePro
PostPosted: May 24th, 2023, 10:06 
Offline

Joined: April 26th, 2023, 10:05
Posts: 14
Location: Europe
Hello,

unter https://www.reclaime-pro.com/manual/forensic-trace.aspx the following is written:

->In ReclaiMe Pro, you can get forensic trace file(s) for the recovered files in .CSV format.
->This feature allows you to know where file metadata like timestamps and file content
->are located on the storage device you are investigating.


Question:
Why it's of importance for a forensic examiner to know where metadata like timestamps and file content are located on the storage device?


Any feedback is appreciated very much. Thank's!

Harry


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: May 24th, 2023, 16:24 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 941
Location: Nederland
In data recovery to put it simply, you just want the data. And so does client. Where you got it, how you got it and all that is irrelevant.

In forensics knowing where a file was, at what time created etc. etc. may be even more relevant than the actual file contents, or equally important. For example, If I am accused of having for example typed some threat, or having forged a document at some time and place, such trace evidence might prove the document was crafted during a time said PC was not in my possession and thus relevant.

Anyway, ReclaiMe Pro didn't always have this feature, it was requested/suggested by someone working in forensics.

Another example: I was once asked to make a jpeg readable (it is was 90% gray) for a forensic case which I did. I was asked a detailed report about what I did and video record the repair so that the forensic guy could tie the file I produced was in fact the same file he pulled from some storage device. IOW, he had to document everything, where he got the file, how he got it and how I repaired it. In such cases this trace information seems vital to me.

Disclaimer: I am not working in forensics, I used my imagination while answering the first example, the second did happen.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: May 30th, 2023, 10:16 
Offline

Joined: April 26th, 2023, 10:05
Posts: 14
Location: Europe
Thank you very much Joep for this qualified answer. It does really help me to understand this feature!

Best regards,
Harry


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: July 7th, 2024, 19:06 
Offline

Joined: November 10th, 2022, 16:20
Posts: 32
Location: localhost
I do not work with forensic, but this sounds like ad mumbo-jumbo. Whatever they define "where" if I were working for forensic I would the tool to show where information comes from. Then I could combine information from different sources for final report.


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: July 8th, 2024, 2:26 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 495
Location: brisbane
I have brought reclaim me when it was launched , since then I have only used it once. Its too CPU intensive & I did not find anything special .
I was not satisfied by fancy front end and layout.


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: July 9th, 2024, 18:39 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 941
Location: Nederland
okton wrote:
I do not work with forensic, but this sounds like ad mumbo-jumbo. Whatever they define "where" if I were working for forensic I would the tool to show where information comes from. Then I could combine information from different sources for final report.


What exactly do you qualify as mumbo-jumbo? As I said I don't work in forensics but I think anyone who does will tell you chain of evidence is holy. That means a tool must log everything it got and how it got it and where it got it from. A file submitted as evidence must be traceable back to the source, every step of the way.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: July 9th, 2024, 18:47 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 941
Location: Nederland
terminator2 wrote:
I have brought reclaim me when it was launched , since then I have only used it once. Its too CPU intensive & I did not find anything special .
I was not satisfied by fancy front end and layout.


Yes, I agree, it's too resource hungry.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: July 12th, 2024, 17:19 
Offline

Joined: November 10th, 2022, 16:20
Posts: 32
Location: localhost
Arch Stanton wrote:
A file submitted as evidence must be traceable back to the source, every step of the way.
Thats my point, this prerequisite for forensic tool, so if they are advertising this as unique feature, that means "ad mumbo-jumbo".


Top
 Profile  
 
 Post subject: Re: Forensic-Trace feature of ReclaimePro
PostPosted: July 13th, 2024, 7:40 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 941
Location: Nederland
okton wrote:
Arch Stanton wrote:
A file submitted as evidence must be traceable back to the source, every step of the way.
Thats my point, this prerequisite for forensic tool, so if they are advertising this as unique feature, that means "ad mumbo-jumbo".


I don't see it, where they label this as unique. They just describe a reporting feature of the program. I happen to know it was explicitly requested by someone working in the forensic field.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group