Forensic Mode

Note: This feature is available for the Technician version of R-Studio only!

When this mode is enabled, R-Studio will generate a forensic data collection audit log that can be presented at court hearings. This log includes information about a hardware configuration on which the forensic data collection takes place and MD5 for recovered files.

Note: A new log will be generated each time the hardware configuration is changed (a hard drive is connected/disconnected, an external USB device is connected/disconnected, etc)

To enable this feature,

*	Select Enable Forensic Mode on the Main tab of the Settings dialog box.

Each time you start file recovery, the Forensic Log Settings dialog box will appear.

Forensic Log Settings dialog box

Enter the required information and click the OK button to go to the Recovery dialog box.

While file recovery, R-Studio will create forensic data collection audit log in the specified folder. Below is an example of such log.

******************************** Forensic Data Collection Audit Log ********************************

R-STUDIO network edition Build 1004/Mar 10 2010

Case Name: Steven v Christofor

Case Number: 28-5-0205-CR-85763

Operator / Investigator Name: J.F. Lewson

**************************************** Drives Information ****************************************

- Drive Number 0 ---------------------------------

* Drive Type [256 bytes]: Computer,Local Computer

* Name [30 bytes]: Local Computer

* OS [32 bytes]: Mac OS X 10.4.5

* System [10 bytes]: i386

- Drive Number 1 ---------------------------------

* Drive Type [256 bytes]: Physical Drive,Disk

* Name [34 bytes]: ST3120811AS3.AAE

* OS Object [22 bytes]: /dev/disk0

* Size [8 bytes]: 111 Gb (234441648 sec)

* Sector Size [4 bytes]: 512 b

# I/O Tries [4 bytes]: Default

+ Drive Control [4 bytes]:

# Maximum Transfer [4 bytes]: 32768

# I/O Unit [4 bytes]: 512

# Buffer Alignment [4 bytes]: 4096

+ Device Identification [4 bytes]:

* Product [64 bytes]: ST3120811AS

* Firmware [16 bytes]: 3.AAE

* Serial Number [32 bytes]: 6PT0J1FH

* Bus Type [4 bytes]: SerialATA

+ IDE Properties [4 bytes]:

* Buffer [10 bytes]: 8 MB

* ECC Bytes [2 bytes]: 4

* PIO Modes [16 bytes]: 1,2,3,4

* DMA Modes [12 bytes]: 0,1,2

* UltraDMA Modes [28 bytes]: 0,1,2,3,4,5,6

* Current Mode [22 bytes]: UltraDMA 5

- Drive Number 2 ---------------------------------

* Drive Type [256 bytes]: Partition,Primary

* Name [22 bytes]: Partition1

* Size [8 bytes]: 29996 Mb (61432497 sec)

* Partition Offset [8 bytes]: 32256 b (63 sec)

* Partition Size [8 bytes]: 29996 Mb (61432497 sec)

* Partition Type [256 bytes]: NTFS/HPFS

+ NTFS Information [4 bytes]:

* Cluster Size [4 bytes]: 4096 b (8 sec)

* MFT Record Size [4 bytes]: 1024 b

* MFT Position [8 bytes]: 3072 Mb (6291456 sec)

* MFT Mirror Position [8 bytes]: 14998 Mb (30716248 sec)

* Index Block Size [4 bytes]: 4096 b

* Sector Size [4 bytes]: 512 b

* Volume Size [8 bytes]: 29996 Mb (61432496 sec)

- Drive Number 3 ---------------------------------

* Drive Type [256 bytes]: Partition,Active

* Name [22 bytes]: Partition2

* Size [8 bytes]: 29996 Mb (61432560 sec)

* Partition Offset [8 bytes]: 29996 Mb (61432560 sec)

* Partition Size [8 bytes]: 29996 Mb (61432560 sec)

* Partition Type [256 bytes]: Mac OS X HFS+

+ HFS/HFS+ Information [4 bytes]:

* HFS Type [62 bytes]: HFS+, Journaled, Not unmounted

* Block Size [4 bytes]: 4096 b (8 sec)

* HFS Version [4 bytes]: 4

* Create Time [8 bytes]: 1.5.2007 19:16:12

* Last Write Time [8 bytes]: 10.3.2010 17:10:55

* Last Check Time [8 bytes]: 2.5.2007 2:16:12

* Volume Size [8 bytes]: 29996 Mb (61432560 sec)

- Drive Number 4 ---------------------------------

* Drive Type [256 bytes]: Partition,Primary

* Name [22 bytes]: Partition3

* Size [8 bytes]: 24003 Mb (49158900 sec)

* Partition Offset [8 bytes]: 58 Gb (122865120 sec)

* Partition Size [8 bytes]: 24003 Mb (49158900 sec)

* Partition Type [256 bytes]: Ext2FS/XIAFS

+ Ext2/Ext3/Ext4 Information [4 bytes]:

# FS Character Set [4 bytes]: OEM

* Block Size [4 bytes]: 4096 b (8 sec)

* First SuperBlock Offset [4 bytes]: 1024 b (2 sec)

* Blocks Per Volume [4 bytes]: 6144862

* INodes Per Volume [4 bytes]: 3074176

* Creator OS [4 bytes]: Linux

* Major Version [4 bytes]: 1

* Minor Version [2 bytes]: 0

* Last Mount Time [8 bytes]: 2.3.2010 15:38:42

* Last Write Time [8 bytes]: 2.3.2010 16:54:45

* Last Check Time [8 bytes]: 22.1.2010 15:32:55

* Volume Size [8 bytes]: 24003 Mb (49158896 sec)

- Drive Number 5 ---------------------------------

* Drive Type [256 bytes]: Partition,Logical

* Name [22 bytes]: Partition4

* Size [8 bytes]: 1953 Mb (4000122 sec)

* Partition Offset [8 bytes]: 82 Gb (172024083 sec)

* Partition Size [8 bytes]: 1953 Mb (4000122 sec)

* Partition Type [256 bytes]: Linux (swap)

- Drive Number 6 ---------------------------------

* Drive Type [256 bytes]: Partition,Logical

* Name [22 bytes]: Partition5

* Size [8 bytes]: 28521 Mb (58412277 sec)

* Partition Offset [8 bytes]: 83 Gb (176024268 sec)

* Partition Size [8 bytes]: 28521 Mb (58412277 sec)

* Partition Type [256 bytes]: FAT32

+ FAT Information [4 bytes]:

* FAT Bits (12,16,32) [4 bytes]: 32

* Cluster Size [4 bytes]: 16384 b (32 sec)

* First Cluster Offset [8 bytes]: 14240 Kb (28480 sec)

* Root Directory Cluster [4 bytes]: 2

* First FAT Offset [8 bytes]: 18432 b (36 sec)

* Size of One FAT Table [8 bytes]: 7127 Kb (14254 sec)

* Number of FAT Copies [4 bytes]: 2

# Active FAT copy [4 bytes]: Auto

* Sector Size [4 bytes]: 512 b

* Major Version [1 bytes]: 0

* Minor Version [1 bytes]: 0

* Volume Size [8 bytes]: 28521 Mb (58412277 sec)

****************************************************************************************************

-------------------------------------------- Session 2 ---------------------------------------------

START Date / Time of Collection: 2010-03-10 20:38:40

Source drive:Sector Modification Date MD5 File Name

6: 6333056 2008-02-15 01:07:42 Video

6: 6333120 2008-01-19 05:47:48 1778568d4a8f7e372e159494a95ed542 Video/1-1.avi

6: 19130048 2009-04-30 03:47:24 710481dff181558bfc9b1bb222d47c56 Video/IMG_7624.jpg

6: 23097376 2009-12-09 22:15:42 Recovered_Files

6: 25473216 2009-12-25 21:07:28 Recovered_Files/Root

6: 4491200 2010-02-03 00:11:08 Recovered_Files/Root

6: 37777280 2010-02-03 23:45:04 Recovered_Files/Root

6: 39615936 2010-02-04 00:17:24 Recovered_Files/Root

6: 4931616 2010-02-19 20:35:48 Recovered_Files/Root

6: 4950240 2010-02-19 20:38:34 Recovered_Files/Root

6: 4950304 2010-02-19 20:39:24 Recovered_Files/Root

6: 4950368 2010-02-19 20:41:00 Recovered_Files/Root

6: 4950432 2010-02-19 20:42:54 Recovered_Files/Root

6: 4975136 2010-02-20 19:18:54 Recovered_Files/Root

6: 4975296 2010-02-20 19:45:24 Recovered_Files/Root

END Date / Time of Collection: 2010-03-10 20:39:50

----------------------------------------------------------------------------------------------------