Backtrack 4 R2 Digital Forensics DCFLDD

[pinguino123698745]

if u r running a live cd (u say that on another video), where does the 20GB get stored?

And if they are stored on the drive itself, can this somehow corrupt the data in it ?

[sexcation]

In regard to drives encrypted using Truecrypt in place, without using DOD 5220.22-M. How difficult is it for a forensic data lab to use a tool like this to view previous unencrypted info?

[MasterO2]

2 questions: 1) the /dev/hda1 partition is unmounted before running this command, right?

2) When you booted Backtrack 4, at the GRUB menu, which mode did you start from? 

[lecturesnippets]

@MasterO2

1) yes, it is not mounted when I run the command.

2) it should not matter if you boot to the default mode or forensics mode, they both should work. Use forensics if you want to keep the disk from changing at all when you boot up backtack.

[sjnovick]

This is a great video. Thanks!

[Screenfreezer]

Thanks!!

At last something new!! It is rare to find these kind of videos, most videos on youtube are always about the same topic (cracking WEP, metasploit, nmap etc...) 5/5

[lecturesnippets]

@Screenfreezer - Thanks for the comment. Let me know if there are any tools you need to see. I plan on covering most all of them starting with the Forensics Tools.

[DjAdam16]

@Screenfreezer Amen brother....