"Richard Smith, a forensic specialist at Boston Software Forensics, said the process of making forensic copies of hard drives can be time-consuming and expensive, costing up to $1,500 and taking several hours to complete per machine.
He added that the process is standard computer forensic work in the private sector and could cost less if economies of scale are considered. Smith said the process involves duplicating the hard drive and then building an index and analysis program to search through the copy of the hard drive."
This sounds like nonsense to me. Why wouldn't one simply copy the active data (using a low-level utility) from the original disk to a compatible replacement and then put the replacement disk into service, keeping the original as the "forensic" copy?
Agreed however that chances of recovering anything useful are close to nil.
No comments:
Post a Comment