You Don't Have the Evidence

Presented at ShmooCon X (2014), Jan. 19, 2014, noon (60 minutes)

Forensic imaging tools have one purpose, to soundly copy every sector on a device to a destination device and report success or failure without changing data. In the last 20 years most forensic imaging tools have not progress and continue to use the same basic code for imaging a drive. When encountering damage many of the tools have no ability to deal with the damage and quit, crash, or worse; do more damage to the drive they are trying to recover from. Imaging damaged drives are where forensic tools are delivering the most disappointing results.

Data Recovery tools and skills are important when acquiring the data from damage disks, but also understanding what you are not getting when imaging a forensic job is just as important. There are special ways to access the data, the controller on the hard drive, repair the damaged boards, and even to adjust heads by turning off damaged ones, copying all the data from the good platters before dealing with the damaged heads. Data recovery imaging tools have some very advanced functions and capabilities for imaging damaged hard drives and damaged sectors that forensic tools are incapable of finishing. I will be discussing these different techniques and the errors exhibited by the drive and sectors to better help understand what you are missing and why.


  • Scott Moulton
    Scott Moulton is known both for his trademark 'Forensic Unit' hat and his unholy knack for finding new data recovery techniques the other experts don't want you to know. Scott is owner of both My Hard Drive and Forensic Strategy Services and fills his days recovering data from all kinds of storage devices, testifying in court, and teaching others to do data recovery. Scott teaches a full 5 Day Forensic Bootcamp Data Recovery Class that includes advanced repairs of badly damaged drives and all the tools used by Data Recovery and Forensic shops. Scott's DIY videos are on

Similar Presentations: