Altirium logo

Posts Tagged ‘Forensic tape examination’

How do you restore Tivoli TSM data for forensic examination purposes

Tivoli Storage Manager (“TSM”) provides a sophisticated heterogeneous data storage environment within which large volumes of data can be held. These might include email backups, user documents and SQL database, in fact all of the information that might be just a little bit useful in a computer forensic investigation or a tape data discovery exercise.

So, you are an investigator who has been handed a case containing 25 LTO4 cartridges from a TSM archive, now what?
Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

Computer Forensics – don’t ignore the tapes

Much Computer Forensic work is associated with data recovery from hard disk drives, USB pens and other common data storage media. Even the television drama departments appear to believe that data is stored only on this limited range of media, I don’t have a back catalogue to check against but I am pretty certain that on Spooks there has never been an analysis of a DLT or LTO tape cartridge. So what about tape? Probably the largest volume of data stored in the world is on tape, so is it of any value in forensic investigations and litigation work?

The hard disk drive in a computer system contains the most up-to date information along with other forensically valuable information such as internet history and local temporary files, so why should you bother looking at the backup tapes?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)