Free DME & DFIR Resources

If you live in the world of digital forensics, you see hard drives of all form factors and ages (along with plenty of dust bunnies). You also likely wipe and re-purpose hard drives quite regularly. You know more acronyms than your typical teen textaholic, and you went out and celebrated with friends when Serial ATA was released, because you were sickened by the old master/slave relationships associated with IDE/PATA drives. So why do we still see jumpers on SATA drives? Rest assured my friends, it has nothing to do with a master/slave relationship.

It’s sometimes difficult for traditional Computer Forensic (CF) examiners to understand why they should treat video and multimedia any differently than other types of digital evidence. After all, a bit is a bit, and a byte is a byte. Right? CF examiners are typically highly trained and highly technical people. If anyone is going to understand how to recover and interpret multimedia data, one would think that a traditional CF examiner would be at or near the top of your go-to list. The problem with this assumption is that multimedia data is fundamentally different than most other types of data, and in more than one way.