<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
<channel>
<title>Digital Preservation Q&amp;A - Recent questions tagged digital-forensics</title>
<link>https://qanda.digipres.org/tag/digital-forensics</link>
<description>Powered by Question2Answer</description>
<item>
<title>Best way to read SCSI tape drive on a modern PC?</title>
<link>https://qanda.digipres.org/1160/best-way-to-read-scsi-tape-drive-on-a-modern-pc</link>
<description>&lt;p&gt;
	We recently aquired a number of DLT-IV and DDS-1 tapes, and we'd like to recover the data stored on them. We already have readers for both tape formats; however these are both SCSI devices, and since modern PCs don't have SCSI connectors we cannot hook them up directly. After a bit of Googling I came up with a few options myself:&lt;/p&gt;
&lt;ol&gt;
	&lt;li&gt;
		&lt;p&gt;
			Buy a SCSI to USB adapter cable (used, as these are not produced anymore). However, I came across some reports that this is not a good option for tape drives, as tape transport commands (rewind, fas-forward) won't work. See e.g. &lt;a rel=&quot;nofollow&quot; href=&quot;https://www.experts-exchange.com/questions/27723240/How-to-connect-a-SCSI-tape-drive-to-server-without-SCSI-interface.html&quot;&gt;here&lt;/a&gt;&lt;/p&gt;
	&lt;/li&gt;
	&lt;li&gt;
		&lt;p&gt;
			Buy a writeblocker that has a SCSI connection. I'd expect that this would have the same limitations as option 1 above (also, these days no-one seems to be making SCSI writeblockers anymore)&lt;/p&gt;
	&lt;/li&gt;
	&lt;li&gt;
		&lt;p&gt;
			Buy a used SCSI adapter card and build that into the machine that is used for imaging (but are these cards even compatible with modern desktops?).&lt;/p&gt;
	&lt;/li&gt;
	&lt;li&gt;
		&lt;p&gt;
			Do the imaging using an old desktop that already has a SCSI card (or is compatible with it). For various reasons I'd rather not go this route unless absolutely necessary ...&lt;/p&gt;
	&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;
	As I don't want to reinvent the wheel, I'm curious if anyone with experience reading SCSI-connected tape drives could give me some recommendations on the best way to proceed with this. (BTW the workstation we'll be using for data extraction runs Linux.)&lt;/p&gt;</description>
<guid isPermaLink="true">https://qanda.digipres.org/1160/best-way-to-read-scsi-tape-drive-on-a-modern-pc</guid>
<pubDate>Wed, 06 Jun 2018 12:00:51 +0000</pubDate>
</item>
<item>
<title>Does anyone have experience capturing and archiving WeChat data?</title>
<link>https://qanda.digipres.org/624/does-anyone-have-experience-capturing-archiving-wechat-data</link>
<description>&lt;p&gt;
	Does anyone have experience capturing and archiving &lt;a href=&quot;http://www.wechat.com/en/&quot; rel=&quot;nofollow&quot;&gt;WeChat &lt;/a&gt;data?&amp;nbsp; I am working with a research group that wants to capture text conversation, emoticon usage, as well as shared audio clips.&lt;/p&gt;</description>
<guid isPermaLink="true">https://qanda.digipres.org/624/does-anyone-have-experience-capturing-archiving-wechat-data</guid>
<pubDate>Tue, 09 Dec 2014 15:51:18 +0000</pubDate>
</item>
<item>
<title>Tools for identifying obfuscated files, specifically password protected and encrypted formats?</title>
<link>https://qanda.digipres.org/588/identifying-obfuscated-specifically-protected-encrypted</link>
<description>&lt;p style=&quot;margin: 0px 0px 20px; color: rgb(119, 119, 119); font-family: Lato, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; line-height: 21px;&quot;&gt;
	I am looking for tools capable of detecting and flagging up encrypted and password protected files in any given collection.&lt;/p&gt;
&lt;p style=&quot;margin: 0px 0px 20px; color: rgb(119, 119, 119); font-family: Lato, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; line-height: 21px;&quot;&gt;
	First there is a necessity for a tool that is capable of doing this and understanding what is out there (and its range and abilities). Second there is a requirement for usability and distribution to a probable non-expert audience.&lt;/p&gt;
&lt;p style=&quot;margin: 0px 0px 20px; color: rgb(119, 119, 119); font-family: Lato, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; line-height: 21px;&quot;&gt;
	&lt;strong&gt;Note:&amp;nbsp;&lt;/strong&gt;This question was first asked in 2013 and a handful of answers canbe found here:&amp;nbsp;&lt;a href=&quot;http://anjackson.github.io/zombse/062013%20Libraries%20&amp;amp;%20Information%20Science/static/questions/1445.html&quot; rel=&quot;nofollow&quot;&gt;http://anjackson.github.io/zombse/062013%20Libraries%20&amp;amp;%20Information%20Science/static/questions/1445.html&lt;/a&gt;&amp;nbsp;&lt;/p&gt;</description>
<guid isPermaLink="true">https://qanda.digipres.org/588/identifying-obfuscated-specifically-protected-encrypted</guid>
<pubDate>Sun, 23 Nov 2014 23:11:54 +0000</pubDate>
</item>
<item>
<title>What criteria should I consider when determining the hardware specs for a disk imaging station?</title>
<link>https://qanda.digipres.org/212/criteria-should-consider-determining-hardware-imaging-station</link>
<description>The person who asked the question at #digpres14 was thinking specifically of the tower that powers the disk imaging station rather than all the peripherals. Another way of framing the question is what are the bare minimum specs (RAM, processor, ports)?</description>
<guid isPermaLink="true">https://qanda.digipres.org/212/criteria-should-consider-determining-hardware-imaging-station</guid>
<pubDate>Wed, 23 Jul 2014 13:46:30 +0000</pubDate>
</item>
<item>
<title>What settings should be used when imaging floppy disks using a Kryoflux device?</title>
<link>https://qanda.digipres.org/199/settings-should-imaging-floppy-disks-using-kryoflux-device</link>
<description>&lt;p&gt;
	&lt;span style=&quot;font-size: 9pt; font-family: Arial, sans-serif;&quot;&gt;I'm trying to write a&lt;span class=&quot;apple-converted-space&quot;&gt;&amp;nbsp;&lt;/span&gt;&lt;a href=&quot;https://github.com/euanc/kryofluxDiskID&quot; rel=&quot;nofollow&quot;&gt;small program&lt;/a&gt;&lt;span class=&quot;apple-converted-space&quot;&gt;&amp;nbsp;&lt;/span&gt;to identify floppy disk formats automatically in order to enable efficient bulk disk imaging.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;
	&lt;span style=&quot;font-size: 9pt; font-family: Arial, sans-serif;&quot;&gt;Details of the approach are outlined&lt;span class=&quot;apple-converted-space&quot;&gt;&amp;nbsp;&lt;/span&gt;&lt;a href=&quot;http://www.openplanetsfoundation.org/blogs/2014-06-26-bulk-disk-imaging-and-disk-format-identification-kryoflux&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;
	&lt;span style=&quot;font-size: 9pt; font-family: Arial, sans-serif;&quot;&gt;As part of this I need the program to create every possible variant of disk image in order to test each to find out which type of disk it actually was.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;
	&lt;span style=&quot;font-size: 9pt; font-family: Arial, sans-serif;&quot;&gt;For this to work I need to know what possible types of disk there might have been. For example, double sided disks, single sided disks, disks that should be read at 300rpm, disks with 40 tracks, disks with 80 tracks, etc.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;
	&lt;span style=&quot;font-size: 9pt; font-family: Arial, sans-serif;&quot;&gt;I will be using the &lt;a href=&quot;http://www.kryoflux.com/&quot; rel=&quot;nofollow&quot;&gt;Kryoflux&lt;/a&gt; device to do this work and the settings options within that include:&lt;/span&gt;&lt;/p&gt;
&lt;ol&gt;
	&lt;li&gt;
		Image Type&lt;/li&gt;
	&lt;li&gt;
		Start Track&lt;/li&gt;
	&lt;li&gt;
		End Track&lt;/li&gt;
	&lt;li&gt;
		Side Mode&lt;/li&gt;
	&lt;li&gt;
		Sector Size&lt;/li&gt;
	&lt;li&gt;
		Sector Count&lt;/li&gt;
	&lt;li&gt;
		Track Distance&lt;/li&gt;
	&lt;li&gt;
		Target RPM&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;Track physical position - side 0&lt;/span&gt;&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;Track physical position - side 1&lt;/span&gt;&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;Start track&lt;/span&gt;&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;End track&lt;/span&gt;&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;Flippy/not flippy&lt;/span&gt;&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;Output Image Track Order&lt;/span&gt;&lt;/li&gt;
	&lt;li&gt;
		&lt;span style=&quot;color: rgb(51, 51, 51); font-family: Helvetica, Arial, Sens-serif; line-height: 12px;&quot;&gt;Disk Density&lt;/span&gt;&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;
	&lt;span style=&quot;font-family: Arial, sans-serif; font-size: 9pt;&quot;&gt;I don't have a lot of knowledge of disk formats however and so am hoping that others will know what settings I should include in the program. For example, are there other RPM that disks were read at aside from 300 and 360? Also, Are there any standard sector counts? (etc).&amp;nbsp;&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;
	&lt;span style=&quot;font-size: 9pt; font-family: Arial, sans-serif;&quot;&gt;I have started a spreadsheet to capture options&lt;span class=&quot;apple-converted-space&quot;&gt;&amp;nbsp;&lt;/span&gt;&lt;a href=&quot;https://docs.google.com/spreadsheets/d/1g_xM_cmUAl2AIYwD3d_2IulZlOG6_JmDDf7FoIRW9EM/edit?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. I do not want to circumvent the use of this site so can you please give any answers you can on this site and in the spreadsheet also if possible. I will ensure that any that are only posted on this site are consolidated in the spreadsheet and included in the program.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;
&lt;p&gt;
	&amp;nbsp;&lt;/p&gt;</description>
<guid isPermaLink="true">https://qanda.digipres.org/199/settings-should-imaging-floppy-disks-using-kryoflux-device</guid>
<pubDate>Mon, 21 Jul 2014 18:06:36 +0000</pubDate>
</item>
</channel>
</rss>