Eric
Primary: You'll want to make an image of the drive, but you
didn't specify the OS. So if it's *nix, try "dd" to make an image file.
If it's Wintel, then you might be able to use Ghost. Of course there's
always EnCase, but you'll need a fob to be successful.
Alternate: You may have to resort to using a sector editor to
examine the drive. If the sector editor is worth it's weight, then you
should be able to save all the used and unused disk space. This might be
time consuming if you can only do a cluster/block at a time.
Then pour the image into a spare drive (Freshly zero'd). Perform
your examination against the spare/work drive.
Thanks,
Matthew Brown, CISSP
"Eric Boltz" <Eric_Boltzat_private>
09/10/2001 12:02 PM
To: FORENSICSat_private
cc:
Subject: Solid State HDD Data Recovery?
Hello All!
I am interested in finding out if there is a way to scavenge data from a
Solid State HDD, as you would from a standard mechanical drive? From what
I
understand, as soon as power is removed from the SSD(and the built-in
battery is drained), all data is irretrievably lost... is this true or is
there a way of examining SDRAM-based drives to retrieve the data?
Thanks in advance!
Eric
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Sep 12 2001 - 10:15:51 PDT