Tag: computer forensics

Mac Target Disk Mode

Booting an Apple Macintosh in target disk mode allows computer forensic examiners to copy relevant files from the internal drive on a Mac computer. Removing hard drives instead from a Mac computer can be time consuming and result in damage to the system when not performed properly. Therefore, target disk...

read more

ESI (Electronically Stored Information) Software Challenges

A couple weeks ago, I outlined what computer forensics and electronic discovery have in common and how they differ. I’d like to expand on this topic by identifying some common obstacles encountered when using popular computer forensic software for typical electronic discovery projects. A typical computer forensic case may involve:...

read more

What is a Forensic Image?

‘Imaging a hard drive’ is a phrase that is commonly used for preserving the contents of a custodian hard drive or server. It can also be used to describe when a custodian hard drive is cloned. It is worth taking some time to understand the differences and the advantages and...

read more

Encrypted Hard Drive Dangers

You have requested a hard drive clone or image and discover that the contents cannot be culled or reviewed. One reason may be hard drive encryption. Encryption involves ”scrambling” the contents of a file or hard drive so that they cannot be viewed without the appropriate key or password. To...

read more

Pinpoint Labs