File System Forensic Analysis

file system forensic analysis This is an advanced cookbook and reference guide for digital forensic practitioners. File System Forensic Analysis focuses on the file system and disk. The file system of a computer is where most files are stored and where most evidence is found; it also the most technically challenging part of forensic analysis. This book offers an overview and detailed knowledge of the file system and disc layout. The overview will allow an investigator to more easily find evidence, recover deleted data, and validate his tools. The cookbook section will show how to use the many open source tools for analysis, many of which Brian Carrier has developed himself.

Coverage includes:

  • Preserving the digital crime scene and duplicating hard disks for “dead analysis”
  • Identifying hidden data on a disk’s Host Protected Area (HPA)
  • Reading source data: Direct versus BIOS access, dead versus live acquisition, error handling, and more
  • Analyzing DOS, Apple, and GPT partitions; BSD disk labels; and Sun Volume Table of Contents using key concepts, data structures, and specific techniques
  • Analyzing the contents of multiple disk volumes, such as RAID and disk spanning
  • Analyzing FAT, NTFS, Ext2, Ext3, UFS1, and UFS2 file systems using key concepts, data structures, and specific techniques
  • Finding evidence: File metadata, recovery of deleted files, data hiding locations, and more
  • Using The Sleuth Kit (TSK), Autopsy Forensic Browser, and related open source tools

When it comes to file system analysis, no other book offers this much detail or expertise. Whether you’re a digital forensics specialist, incident response team member, law enforcement officer, corporate security specialist, or auditor, this book will become an indispensable resource for forensic investigations, no matter what analysis tools you use.

Read More

10 Tips For Choosing Hard Drive Data Recovery Software

10 TIps For Choosing Hard Drive Data Recovery Software Hard drive damage primarily results in data corruption. The damage can be caused due to various logical factors like improper system shutdown, file system corruption, software bugs, metadata structure damage, and operating system malfunctioning.

Most computer users wind up needing to recover lost data at one time or other. Luckily, you can choose hard drive recovery software to help retrieve your lost files. There are many options available, so you need to know what to look for before you buy hard drive data recovery software.

  • Check to make sure the software you buy will support the file type you need restored before you buy hard drive recovery software. Not all hard disk recovery utilities are the same.
  • The recovery software should recover your data after all the logical corruption scenarios like virus attack, boot sector corruption, accidental deletion, partition damage, and file system corruption.
  • The software should use high end scanning algorithms to completely scan and recover lost, missing, or inaccessible data from your hard drive.
  • The application should support recovery from all kinds of storage media like hard drives, CD, DVD, USB flash drives, and more.
  • The recovery utility should recover all kinds of different file formats like .DOT, .DOTX, .XLT, .XLW, .XLB, .XLTX, .POT, and .POTX.
  • The recovery tool should be embedded with all the latest features like disk imaging, disk cloning, Find file option, S.M.A.R.T and more.
  • The tool should provide a preview of all the files and folders, and provide an option to the user to select and recover files as per his/her requirements.
  • Use price as your guide when you buy hard drive recovery software. There are a lot of different programs on the market, which can be overwhelming. The price generally ranges from 75 dollars for an undelete program up to 400 dollars for more powerful programs used by professionals. If you stay within 80 to 120 dollars, you will have a good utility that can accomplish a lot.
  • Choose hard drive data recovery software that is user friendly. The directions should be easy enough for you to run the program on your own.
  • The software should be completely non destructive.

See my another post: Best Data Recovery Softwares 2009

Read More

Fiscal Fourth Quarter and Year-End 2011 Financial Results

Seagate Technology
seagateDemand for disk drive storage continues to grow as quarterly shipments reach a record 52 million units and fiscal year shipments increase to a record 199 million units.

Seagate Technology reported financial results for the quarter ended July 1, 2011. Seagate shipped 52 million hard disk drives and reported revenue of $2.9 billion, gross margin of 19.3%, net income of $119 million and diluted earnings per share of $0.27. On a non-GAAP basis, which excludes the net impact of restructuring, write-down of an equity investment, gain on the sale of one of its facilities, and expenses related to the previously announced transaction with Samsung, Seagate reported net income of $126 million and diluted earnings per share of $0.28 for the quarter ended July 1, 2011.

For the fiscal year ended July 1, 2011, the company reported revenue of $11.0 billion, gross margin of 19.6%, net income of $511 million and diluted earnings per share of $1.09. On a non-GAAP basis, which excludes the net impact of loss on redemption of debt, purchased intangibles amortization, restructuring, write-down of an equity investment, gain on the sale of one of its facilities, expenses related to the previously announced transaction with Samsung and tax adjustments related to prior fiscal years, Seagate reported net income of $578 million and diluted earnings per share of $1.24. Additionally, Seagate returned $77 million to shareholders in the form of a dividend and repurchased $822 million of Seagate ordinary shares.

“Seagate and the industry are benefitting from the significant demand for storage related to new applications and architectures associated with mobile and connected devices, Because hard disk drive storage is a fundamental technology for cloud service providers, data centers and all other network-based content providers, total industry demand grew almost 40% in fiscal year 2011 to 330 million terabytes. For the June quarter, Seagate’s average capacity per drive shipped grew to approximately 590 GB an increase of 39% year-over-year. As more online content and services become available to billions of connected mobile devices, we expect demand for storage capacity to continue to grow and Seagate to benefit from this growth.” said Steve Luczo, Seagate chairman, president and CEO.

Related Link: Seagate Q4 FY2011 Financial Statements

Western Digital Corp
wdQ4 REVENUE OF $2.4 BILLION AND NET INCOME OF $158 MILLION, OR $0.67 PER SHARE

For the quarter, revenue totaled $2.4 billion, net income was $158 million, or $0.67 per share, and hard-drive unit shipments were 54 million. The quarterly results included total expenses of $35 million associated with the planned acquisition of Hitachi Global Storage Technologies (Hitachi GST) announced Mar. 7, 2011, and for unrelated litigation accruals. Excluding these expenses, non-GAAP net income was $193 million or $0.81 per share.1

In the year-ago quarter, the company reported revenue of $2.38 billion, net income of $265 million, or $1.13 per share, and shipped 50 million hard drives. The 2010 results included $27 million of expenses related to litigation accruals. Excluding these expenses, the year-ago quarter non-GAAP net income was $292 million, or $1.24 per share.2

The company generated $447 million in cash from operations during the June quarter, ending with total cash and cash equivalents of $3.5 billion.

For fiscal year 2011, the company posted revenue of $9.53 billion and net income of $726 million, or $3.09 per share, compared to fiscal 2010 revenue of $9.85 billion and net income of $1.38 billion, or $5.93 per share. The 2011 net income included total expenses of $44 million associated with the planned acquisition of Hitachi GST and unrelated litigation accruals. Excluding these expenses, fiscal 2011 non-GAAP net income was $770 million or $3.28 per share.1 The 2010 net income included $27 million of expenses related to litigation accruals. Excluding these expenses, fiscal 2010 non-GAAP net income was $1.41 billion, or $6.05 per share.2

“In the June quarter, we were able to meet stronger than anticipated demand, especially from our OEM customers, We believe the stronger demand was driven by increased use of sea freight in advance of the second half of the calendar year as well as supply continuity concerns in the aftermath of the Japan earthquake.

In a challenging HDD market environment in fiscal 2011, the industry saw unit volume growth of four percent while WD achieved growth of six percent as customers demonstrated a continued preference for the WD value proposition.

We remain focused on completing our strategic acquisition of Hitachi GST. We are continuing to engage in the approval process with all the appropriate regulatory agencies and thus far we have received clearance from Brazil, Taiwan and Turkey. We continue to work closely with the remaining agencies which are reviewing our transaction. As previously announced, we now expect that the transaction will close in the fourth calendar quarter of 2011, and our integration planning activities continue on schedule.” – said John Coyne, president and chief executive officer.

Related Link: Western Digital Fourth Quarter Fiscal 2011 Investor Information Summary

Read More

Western Digital Hard Drive Families (Part II)

C) External Hard Drives
Desktop

  • My Book 3.0
    This stylish external hard drive features a SuperSpeed USB 3.0 interface for the fastest transfer rates available on an external hard drive.
  • My Book Elite
    An elegant, easy-to-use storage solution with WD SmartWare backup software, customizable e-label, and password protection.
  • My Book Essential
    An elegant, easy-to-use storage solution with WD SmartWare backup software, password protection and capacity gauge.
  • WD Elements Desktop
    Simple, reliable, portable storage.

Desktop for Mac

  • My Book for Mac
    An elegant, easy-to-use storage solution with automatic, continuous backup software, password protection, and capacity gauge. Compatible with Apple® TimeMachine™.
  • My Book Studio LX
    A super-fast storage solution for your Mac in a premium aluminum enclosure, featuring a customizable e-label and hardware-based encryption. This Apple Time Machine-compatible drive is the perfect complement for your Mac.
  • My Book Studio
    An elegant, super-fast storage solution for your Mac with automatic, continuous backup software, password protection and customizable e-label.
  • My Book Studio Edition II
    Quad interface, RAID-enabled, about 30% less power consumption, formatted for Mac®. The My Book Studio Edition II treads lightly on the earth and carries big performance for creative professionals.

Portable

  • My Passport Elite
    This ultra-portable USB drive is packed with smart features like automatic, continuous backup, password protection, an illuminated capacity gauge and a convenient grab-and-go dock.
  • My Passport Essential SE
    This stylish, compact portable USB drive now features maximum capacity for all the chapters of your digital life.
  • My Passport Essential
    Our smallest, portable drive ever is also our smartest with automatic, continuous backup and password protection.
  • WD Elements Portable SE
    A portable hard drive with maximum capacity in a compact design for easy plug-and-play storage on the go.
  • WD Elements
    Simple, reliable, portable storage.

Portable for Mac

  • My Passport Studio
    This ultra-portable, Mac-ready drive is packed with innovative features like a fast FireWire 800 interface, customizable e-label, and visual, automatic, continuous backup.
  • My Passport SE for Mac
    This stylish, compact portable USB drive now features maximum capacity for all the chapters of your digital life.
  • My Passport for Mac
    An elegant, easy-to-use portable storage solution with automatic, continuous backup software and password protection. Compatible with Apple® TimeMachine™.
Read More