Version française   Home | Contact Us

Hard disks


Given the volume and the type of data they contain, hard disks are subjected to a particularly stringent protocol.

The use of this protocol is all the more justified because of the fact that hard disks are very fragile both physically and magnetically.

By following this protocol, we:

  • Guarantee total protection of the disks analyzed, both as concerns the physical disk (handling, protection and returning of the disk) and as concerns the data it contains, since the protocol imposes the absolute principle that prohibits any modification of the data or the metadata in the addressable space.

  • Identify the data entrusted to us by two independent processes that log the data digitally when it arrives in our laboratory, and log it again after analysis before it is sealed and returned to the owner.

  • Make a complete bit-screen image of the entire addressable space on the disk and guarantee that this copy is identical to the original disk.

  • Retrieve the available metadata from the disk via the SMART database.

  • Back up this copy by duplicating it and storing it on both local and remote means.

    The protocol is only limited by the condition of the medium. At LERTI, we do not analyze seriously damaged disks (such as disks damaged by fire or prolonged immersion in seawater). We use the services of a specialized company working under contract. We rarely encounter seriously damaged disks.

  • However, we do come across the usual disks that are apparently in good condition, but more and more often these contain bad sectors. This is particularly true with portable computers. These bad sectors prevent complete bitwise copies and in general, make it impossible to obtain a constant signature.

    We at LERTI can take measures to avoid bad sectors and limit signatures to acquired sectors.

    © 2017 Lerti: Computer forensics - Legal clauses - Computer forensics, evidence collection, traces, electronic investigations - Compiled by Kreatys