Belkasoft wrote:
Ah, but that depends on who pays for it, and why. Using any commercial tool is certainly easier than Photorec. It's also usually much faster to use a single tool than two separate ones; not just because you save time on not doing a duplicate job, but also because a smarter tool can actually exclude allocated areas from the search, reducing the time for scanning the disk quite dramatically. So I guess the choice of using a free vs. commercial approach depends pretty much on whether or not you're paid by the hour :)
Yes and no.
I personaly see nothing "difficult" in using a command line tool, and as a matter of fact the way the OP posed the question:
TheOJM wrote:
And also can this data be recoverd by free forensic software such as FTK Imager or does paid software enable me to do this?
sounds to me like he is somehow hoping to find Freeware tools to do the job.
But of course it depends, compare how I tend to disagree with the use of Commercial tools:
http://www.forensicfocus.com/Forums/viewtopic/t=9729/
for study.
The free thingies tend to be (generally speaking and with no offence whatever intended for the good Authors that provide them) more rudimental, simple and direct to the (more limited) point, while Commercial tools (and again no offence intended to their Authors) besides a more polished and simplified UI (and hopefully more powerful engine) tend to do things "automagically".
For the experienced investigator/data recovery specialist they do offer a nice way to do more in less time, the risk (now it is becoming philosophy <img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" /> ) being that the tool is treated (by the less experienced user) as a magical spell that will do the miracle, i.e. (and I have actually seen them used this way) that the tool allows for being used by a "trained monkey", and IF (and WHEN) it fails there is a neat "Nothing else can be found" or "Nothing else can be recovered" kind of "verdict" while all is needed is some ingenuity, dedication and tests with other means/methods.
If you prefer, I often have the impression that due to a number of factors (which do include time, money, etc.) in not so few cases the actual program (Commercial and actually and objectively very good) becomes to be regarded more as an oracle than as what it is (a tool).
jaclaz
↧