I have forensic images of two HDD where there has been used comodo timemachine and all the disk usage after certain date is not commited to the disk.
So the usage of the disk is not visible to forensic tools, it lives in the snapshots(stored in some program specific format in unallocated space) that is not accessible to forensic tool.
The original PC from where the disk images comes from is not available so theres no possibility to boot images and commit snapshots to disk.
anyone that have experience with this problem/solution ?
↧