Wish list for forensic features

[Sales]

Dear Users,

What forensic features would you like to have in PC-3000 UDMA and Data Extractor?
MD5 hash will be frequent reply, we guess, but what other features do you need often if you perform forensic data recovery?

All your replies will be much appreciated!

[einstein9]

I Would recommend to fix the following issues in DE:

1- When selecting multiple folders for recovery the Status BAR in DE is NOT UPDATING total file size (you can check and verify it)

2- in Utility, i would recommend checking length of hdd model detected specially WD, i always add my Ref. Case # at the end of detected model, and when i do so, next time i open utility and FW resources are there it will NOT show it in Profiles i made if length is long. verify this in your side also.

i guess this is all what i can remember for now, but sure will update you again here

Many thnx

[pcrecovery]

I have had 3 cases recently in which the drives needed to be recovered with PC3000 and/or hardware imager BEFORE they could be analyzed by our forensics lab. I think that good reports/statistics are a very important feature for any device which is used for computer forensics. Often, the original suspect drive cannot be imaged by any other device.

Basically, even devices that "do the job well" lack detailed reporting. PC3000 already has very good logging and this should be quite easily done. I'm curious to know if there will be a FORENSICS MODE of operation?
I would suggest something like that. No matter what forensics functions are added, I think each action should be logged in detail.... actually, since PC-3000 already has image to FILE, this facilitates the ability to make DD, E01, etc image files as well!

Last year I noticed that TIME used on another imaging hardware product was "probably UTC" but in the reports, it did not say UTC. We decided NOT to use the reports from this device because the time locale was not specified. We would have liked very much to use the report, but the times did not say UTC and did not agree with our other personnel's chain of custody times, etc.

I think PC3000 already has all of the power and important functions (already has write-protect/READ-ONLY/ability to perform Secure Erase, Data extractor is best imager in world, etc) Other than hashing, I think it has most everything else already. I would like a forensic mode of operation in which Case Management is used. The ability to enter my case name and number, examine name, etc. and allow me to identify source drive which is write-protected, prepare destination drive, image and calculate hash , etc.

Recently, we had a case where the opposing party could not image a laptop drive. Their examiner tried, but his imager would take days or weeks to do it and kept failing. Our imager did it in few hours , and the biggest problem and hardest part of the job was the DOCUMENTATION and REPORTING....what exactly we did, how we did it, etc. Also, since the original source/patient was badly damaged, our examiners could only work with the CLONE we produced. I wish we could have used PC3000 to make a forensically sound image file with hash verification. This would have saved us time. Because, we had to 1st make a clone, then transfer clone to forensics dept. and they did the hashing of the clone.... basically we never able to calculate a hash of the original patient, since that function was not available at the time.

Hope this is useful.

[admin]

Hello,

Thanks to all for comments.

To einstein:

1. We're going to add this feature of marked folders/files size calculating in the next update of PC-3000 UDMA+DE
2. Please show here example of how it should look, with some pictures.

To pcrecovery:

This is how we see possible MD5 hash implementation in PC-3000:

Data:
defective drive-patient
prepared drive-donor for imaging

Tasks:
image data from drive-patient to drive-donor (sector by sector copy)
calculate MD5 hashes of patient and donor drives, check its identity

Algorithm:

1. drive-patient is connected to one of ATA ports of PC-3000 and is source of data
2. drive-donor is connected to another ATA port of PC-3000 and is destination of data (drive-recipient)
3. create new “make data copy” task in DE
4. launch the copying process
5. when copying process is finished the MD5 hash of drive-patient is calculated and displayed in LOG (“calculate MD5 hash” option would be also available in context menu of disk in explorer mode of DE, see picture)
6. create new task in standard explorer mode, source device is drive-donor that is copy of drive-patient
7. launch MD5 hash calculation in context menu of drive (see picture), result will be displayed in LOG
8. compare hashes of drive-patient and drive-donor

1.jpg (86.23 KiB) Viewed 42799 times

Would this be enough and convenient for forensic purposes?
Any comments and additions are appreciated.

[einstein9]

here you go image attached.

last night i got a very nice option really for DE but i forgot what was it, am trying to refresh my memory and will post it here again

thnx for the fast reply Sheremetov

[einstein9]

I Just remember now what was it

Since am a Tools Collector, i got and always buy new tools for DR and comparing all tools with my lovely UDMA

the last tool i got called: DFL which has a nice option on it am using a lot, it is the following:

- Sometimes i work with drives (cses) here where i don`t have a loader for it in my DB, this tool can READ TRACKS with safe-mode jumpers and from Tracks it will Generate Modules for you
which includes the Loader. the option called: Track Split to Modules

this option saved me many times when i don`t have a loader for that drive (am talking about WD here)

- Also it has another option which is also good for me called: CHS LBA Translate which tells me any Specific bad sector is located in Which HEAD for example
and i can judge if the HEAD is weak or most of bad sectors are located inside it.

Another Option also:

- If i try to write WRONG ROM ver. to the hdd, DFL will tell me and Warn me this is NOT COMPATIBLE but UDMA will write direct without asking.
maybe this is newbie option but still good really sometimes.

- Formatting P/G list has an Indicator which you can judge how long this process will take for example and you can estimate the time needed.

this is in brief the options am comparing between this tool with my UDMA, i really hope this will help you here on updates or maybe new things you might add in updates.

all those options are 1 click option, but this DFL is not for newbies really, you need to know what you are doing or you will kill your hdd with stupid wrong choice.

Many thnx


btw, just for the info. here, my compare here between this new DFL tool and UDMA are in options i see in hand and how easy it is , but this doesn`t mean this tool is great, for my LAB i like to have all tools and sometimes you do things easier in tools compared to another tool. but this also help your developers to maybe pay attention to some features which might help the users like us who work in daily bases in many cases.

hope this will help you here guys and good luck

i cannot wait for the next update.

[300ddr]

This is unrelated to "forensic features" but I'd really appreciate an updated English manual.

[pcrecovery]

Return to TOPIC....Sheremetov, Thank you for insight into what the forensics options and functionality might be like. I think it is important to log every action that the user has taken from the moment we enter Forensics mode of operations. This is important from legal and chain of custody perspectives. Wouldn't our log from DE contain ALL ACTIONS TAKEN by investigator? I think it should and probably would, as long as any actions taken which required usage of Active Utility would be logged.

I think this Forensic Mode would be part of DE and since DE can already call Active utility for source drive to accomplish heads mapping, password, etc., it should not be too difficult.

I imagine it like this:

1. Select New FORENSICS Task (new mode of operation in DE). Just like New Task, but tells software we want forensics options and mode of operation.
2. New Screen asking for Case ID/number, Investigator name...just a few things used in reporting and forensics...like most forensics software (FTK, Xways, etc).
Just some useful information for log/report.
3. Since it is extremely important not to alter source, we need to be 100% that correct drive is write-protected = read-only...maybe something simple to make this notice or message known.
4. Include some destination drive preparations as part of this task. Allow wiping of destination drive via secure erase and maybe other methods (all 0, 1, etc)
5. Allow use of active utility (already done in DE, so this is nothing new). I imagine this case: Even if we have latest DDI 4 with forensics add-on, there can be a problem with creating heads map of Samsung and others. Only PC-3000 with DE can help us in such cases. So, it is quite common that DE is the only device that can create the image anyway. Having the hash which you illustrated above becomes very welcomed and will save us time! In the past, we would have to make normal copy with DE, then another copy of this clone with FTK imager, etc. TWO processes . Double work IMHO.

We are awaiting forensic addon for DDI4 at this time and imagine utilizing UDMA for more problematic cases and drives which cannot be handled by DDI4. I have already dealt with a drive recently which DDI struggled with because it could not make headsmap of the model. Often we need to avoid these weak or dead heads to get "best evidence" or most data .

Question: Will GOOD source drives allow imaging to DD / RAW file? DE already supports imaging to FILE. Already DE supports file image in the same location as the task. This is great, because we should be able to connect a larger destination drive and house our report and/or log and Forensic DD image with hash and verification on it.

[einstein9]

This is unrelated to "forensic features" but I'd really appreciate an updated English manual.

I never said what i wrote is related to forensic, i was comparing options i have here and not having there, and wish to have it in my UDMA this is one my dear

#2 if you talk about forensic Tools suck as FTK for example, we are talking about a company Specialized in Forensic Digital Evidence Tools which was something in 198x if am not mistaking here
their BASE work is Forensic but UDMA is Mainly in Data Recovery which by combining both in one you will have a Master Tool for BOTH

now, asking us here to provide some sort of wish list in UDMA/DE for forensics is really i don`t know how to explain it, but I did work for more than 12y In forensic cases in my country
and we have the FTK , for us here mainly I use my UDMA more , extracting whatever can be extracted (evidence data) for the court and really and no joke here this is for acelab sales/support

if you needed to add Forensic Options for your product line, you will Have to get your FTK and see how it works , then you will know what exactly you need to add options/features for your product
to have the Best in both DR & Forensics but this will take a lot hell of time doing so.


Last, and this is for you 300ddr

Imagine the options i listed before in your UDMA and you will feel exactly what i mean here.

good luck both.

[einstein9]

Well Last night i was thinking about something in DE as a wish list really

I Added many many file Headers for custom files into DE, but i always think of having some sort of EXPORT settings (for backup)
so that i don`t need to go n add it all over again


A Small Modification will be also Great inside DE about this issue for example in RAW Recovery
Grouping File Types like in R-Studio for example:

Images
Video`s
Word Processing (xls, doc, ppt...etc)

this will be much better when selecting specific types wanted.

hope this helps also

thnx

[pcrecovery]

We use FTK (latest) daily. We do NOT wish to have any of FTK features in PC3000. Personally, I think it makes perfect sense for UDMA to focus soley on the acquisition/imaging of source drive(s) .
This weekend, we had to use PC3000 UDMA in a forensic acquisition. There were many hard drives and virtual PC's that were imaged this weekend. One hard drive gave the on-site team trouble. This drive was brought to the data recovery lab and we used PC3000 to give us access (read-only) to the problematic drive. Like many drives, this drive caused other machines to crash or lockup , etc. Luckily, we were able to use the universal utility to mount the drive in a read-only fashion and as use PC3000 to disable auto-reallocation and hiding of defects,etc. We of course had to use third-party software FTK imager to make the forensic copies needed. What if this drive were more damaged? What if we could only image the drive in DE to another drive? We would have to make the forensic copy and paperwork to show all of these actions and copies from one drive to another to still another.... so you see, having DE calculate and verify the hashes (MD5 , SHA1, etc) would be time-saving and greatly appreciated! I would be more than satisfied with the ability to make Forensic copies to both FILE(S) and/or DRIVE(s).

[lkakt5bb]

I'd like to have a feature to try to copy defective sectors in the G-List with a reporting feature (how many and which could be copied). This could be importent in special forensic cases.

[lkakt5bb]

The reporting should also be extended. Presently it shows "From LBA", "To LBA" and error, "BAD/SKIP/etc.". It would be nice to have an amount field, a head field and total statistics, which should be easy to implement. With the head field, one could see if the errors are caused by a single platter or head.

A really nice feature would be to show if the bad/skipped sectors are logically in use by the file system or not and if so, which files they belong to. It could look like this:

(Tab delimited)

Amount | From LBA | To LBA | Error | Head | Used by File
2 | 7628770 | 7628771 | BAD | 0 | C:\WINDOWS\system32\config
3 | 18379833 | 18379835 | BAD | 0 | None/Unused
2 | 18379836 | 18379837 | SKIP | 0 | None/Unused
2 | 18379838 | 18379839 | BAD | 0 | None/Unused

Totals:
BAD: 7
SKIP: 2

The reporting could also have fields that can be customized to the indivdual lab.

I use PC3000 daily for forensics, this would really help reduce the manual searching and calculating.

[einstein9]

As i explained before about the problem with images
I see its the same on v5 now

As i mentioned before, i sometimes use LONG profile name, on attached image here you will notice that the Profile is ALREADY there on Family folder
but NOT LISTED in UDMA profiles.

i took screenshot image to show you this, i had it before but never made one, now you have it and you can see it

thank you

[Sales]

Thank you everybody for your replies.
We will pass relevant information to our development team.

Always feel free to share us with your recommendations here in forum or e-mailing directly to sales@acelab.ru.