Help with Image files

[Terrigger]

Hi All,

I am totally new to all this and not the best with computers, but I need to fully investigate a hard drive containing files belonging to my wife who died last year. Could be critical stuff so I hope someone can give me a little help.

I have completed an image of the hard drive and can see all the image files and read the hex code withing image files. What do I do now to find emails and deleted documents and dates for documents? Is it possible to reconstruct the drive from the image files as if it were cloned?

Thanks

[David (PassMark)]

If it was something really important you might consider getting in a computer or digital forensics expert.

You might be confusing disk images (a full copy of the hard drive) with image files (JPG, PNG, etc..).

If you are using OSF then the basic steps are,

- Create a case
- Add the disk image to the case
- Use the Delete File Search module if you think there are interesting file that were deleted.
- Use the Email viewer, if you know where the E-mail files are.
- Use the Create index / Search index functions if you are looking for Emails or documents that contain particular keywords.
- Use the File system browser and File name search function to location specific files.
- Use the Recent activity function to pull up a list of recently accessed URLs, Files, etc..