The Problem With Disk Imaging

When you hear of data recovery companies using disk imaging as part of their process, this is done to create a Bit by Bit copy of the customers hard drive. This then allows work to be carried out on a copy instead of the original. It can also be used to take the data off the customers hard drive in a controlled manner, especially when the hard drive shows signs of being unstable. In those situations this process usually works well and has a very good success rate, but what if the customers hard drive is part of a criminal investigation that requires forensic evidence for court proceedings.

This then takes the whole disk imaging process to a different level. A hard drives data storage is not as straight forward as it appears when you see it on your computer. The hard drive manufacturer allows the user access to the majority of the hard drives storage space, but there are areas of the drive that are kept free and protected (HPA) for use by the manufacturer only. It is these areas that are not normally carried over in a standard Bit by Bit imaging process used by most data recovery companies.

Technically If someone wanted to hide specific data and had the use of specialist tools, they could hide data within these protected areas. There are also many other alterations, that can be carried out to a hard drive to hide user data, so it can be a bit of a mine field for forensic data recovery. To read a more detailed technical description then please see the following article about Forensic Imaging.

Leave a Reply

Your email address will not be published. Required fields are marked *