Forensics Add-On for DeepSpar Disk Imager

This option adds the following forensics functionality to the advanced data recovery capabilities of the DeepSpar Disk Imager 4:

• Forensically sound imaging process. It is impossible to write to the source hard drive.

• The ability to remove or view unknown HDD User and Master Passwords for the majority of hard drives.

• Ability to use Vendor-specific ATA commands to disable Auto-Relocation of bad sectors, so that you retrieve more data rather than lose it. Read more about this process in our whitepaper "Disk Imaging: A Vital Step in Data Recovery".

• An option to image any healthy storage device connected to the PC to a raw DD image file. Sector by sector imaging is still required for data recovery functionality.

• Full logging of every action taken by the investigator when working on a case.

• Normal and Enhanced Security Erase for the destination drive.

• Access to the DCO hidden area.

In addition to the above, file-level forensics reporting functionality is introduced. This forensics File Status Report contains the following data for each imaged file: absolute path, filename, size, create date, modify date, total number of sectors, integral sectors, corrupted sectors, unreadable sectors, unprocessed sectors, location of all file fragments, MD5 hash, and more.

When dealing with hard drives that contain bad/unreadable sectors, it is important to know exactly where those bad sectors are located. They may be present only on unused space of the drive (and therefore are of little consequence) or they might be in critical evidence. The main purpose of such a report is to address this issue and to show the integrity status of specific files in order to prove that evidence files are fully integral or partially corrupted. A basic example of the File Status Report: