December, 2006

Data Carving Issues

by Chetan Gupta, NII Consulting

Many a times as an investigator, I have to deal with the issue of carving data from
unallocated spaces in a partition. There are many commercial data carving tools such as Encase, Winhex, Accessdata FTK, DataLifter, ILookInvestigator. Well, I have tried most of these and must say most of them have their share of pros and cons.

Read the full article »

Bad Superblock, corrupt inode tables and loads of bad luck!

by Chetan Gupta, NII Consulting

Well, last week was abuzz with activity when we had to recover data from a corrupt Linux hard disk. Thought it would be pretty easy but as soon as I loaded the hard disk, I knew something was amiss.

Read the full article »