Active@ KillDisk

🧼 Media Sterilisation

Before copying evidence or making a disk image, one needs to sterilise the target media to ensure that data on that disk before this operation would not meddle with the evidence data. Several rounds of writing 0s are usually enough.

NTFS

Developed in collaboration with IBM. POSIX compliant. Official docs for NTFS here.

❗️ Everything is a file! ❗️ All offsets are relative to the start of the data structures. ❗️ Apple macOS machines can read NTFS devices but do not support writing to them by default.

The entire logical volume is a data area (in contrast to FAT where there is a system area as well ❓).

In a Microsoft NT File System (NTFS), hot fixing of disk sectors prevents data from being stored in a bad sector or cluster.