Free DME & DFIR Resources

If you live in the world of digital forensics, you see hard drives of all form factors and ages (along with plenty of dust bunnies). You also likely wipe and re-purpose hard drives quite regularly. You know more acronyms than your typical teen textaholic, and you went out and celebrated with friends when Serial ATA was released, because you were sickened by the old master/slave relationships associated with IDE/PATA drives. So why do we still see jumpers on SATA drives? Rest assured my friends, it has nothing to do with a master/slave relationship.

Imagine the following scenario:
You're the first responding officer to a crime scene and have just completed taking the victim's statement. You then tell the victim you have to leave for another call. Before you go you politely ask the victim to take photos of the scene and their injuries, collect all of the DNA and fingerprint evidence, and note that you'll either be back later in the day or maybe tomorrow or the next day to pick it all up. You note that they can just leave the evidence at the front desk for you.

This is exactly how many agencies have chosen to deal with the overwhelming amount of DCCTV evidence available to them today. "Oh, there's video? Okay, have someone export it and we'll come back to pick it up."