Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20121

General Discussion: How did the suspect hide these folders?

$
0
0
FWIW, I had a similar error with FTK. Mine simply stated "Block index out of bounds". This was a Micro SD Card, formatted Fat32 found in a ZTE cell phone. The phone was not reading the card except to ID is as a Toshiba brand card that needed to be 'set up' to be used. When connected (Via Write blocker of course) to windows, windows wouldn't even try and only wanted to format the card. Initially I considered this to be a corruption issue with the card, but FTK, and EnCase both saw two partitions, one named android_meta and the other android_expand. Android_meta was only 16Mb and contained a semi readable folder structure and several files, all of which were deleted/over written and some of whom had a logical size far exceeding the 16Mb capacity of that partition. Android_expand was 3.6GB and appeared encrypted/corrupted. From what research I did it appears that this card is setup to be 'adopted storage' from another phone before being moved to the ZTE phone. But I digress enough. It's not too huge a deal for my case so I kinda dismissed the FTK error as having something to do with the card being encrypted or the way in which 'adopted storage' works. But in reading this thread I thought I'm mention it in case my 'off topic' story jogged a thought with someone.

Viewing all articles
Browse latest Browse all 20121

Latest Images

Trending Articles



Latest Images