Hi Frank, This document - http://oasis.palm.com/dev/kb/papers/1145.cfm gives some details of what happens during a soft or hard reset (under the heading "Memory Reset".) Kind regards, Mac >From: Frank Knobbe <fknobbeat_private> >To: forensicsat_private >Subject: Empty Palm >Date: 29 May 2002 20:08:48 -0500 > >Greetings, > >in a recent acquisition we created EnCase images of a couple Palm >Pilots. Could someone please confirm to me in email what exactly an >'empty' palm looks like? One of those Palms didn't turn on and had to be >reset. The EnCase data is pretty all zero's with the exception of a >repeating block of U's. That was somewhat expected after the reset. The >other Palm is pretty much all zero's as well, but with a repeating, 500 >byte block of data (repeating every 65535 bytes). > >The Palm's weren't really in the scope, but we acquired them anyway >since we had the opportunity :) So if the acquisition was flawed, it's >no harm to the case. I'm just trying to figure out if what I'm seeing is >normal, or if something messed up with EnCase (v 3.19 btw) during the >acquisition. > >Thanks, >Frank > ><< signature.asc >> _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu May 30 2002 - 09:53:38 PDT