jaclaz wrote:
BTW (and as a side note) I believe that (at least in many countries) the LE/Prosecution has to provide to the defense the actual unmodified hard disk images and not a bunch of files copied to a hard disk.
If the images have been copied maintaining date/time of the original filesystem, dividing them in folders by date would make a lot of sense.
LE does not have an original hard drive. It's an odd case making it very difficult to process. In fact, the prosecutor is struggling trying to figure out a way to manage this data.
So far, I haven't seen much exif data in the photos. Many of them are simply memes downloaded from the internet and shared.
In addition to the images, we have a massive amount of documents that are saved in obsecure ways that prevents searching and manipulation by most programs.
I decided to dump everything into FTK because it could at least organize the files (about 1.5 Million potentially relevant files in total), and do some filtering for me.
↧