The problem with forensic recovery, like the type you’re speaking about with regards to previous memory states, is I think everyone is working off of copies and copies of copies. Do we know if Maxey has the original drive still?
A copy will only preserve the present bit, as far as I’m aware, not the underlying “previous states”.
Would be interested in some other opinions on this, though. The 450gb raised my eyebrow too.
I'm no expert, but I believe you're correct about copies only taking the surface data. Yes, things can be recovered if they have been deleted on THAT drive, but once you copy it elsewhere that's no longer an option.
The problem with forensic recovery, like the type you’re speaking about with regards to previous memory states, is I think everyone is working off of copies and copies of copies. Do we know if Maxey has the original drive still?
A copy will only preserve the present bit, as far as I’m aware, not the underlying “previous states”.
Would be interested in some other opinions on this, though. The 450gb raised my eyebrow too.
I'm no expert, but I believe you're correct about copies only taking the surface data. Yes, things can be recovered if they have been deleted on THAT drive, but once you copy it elsewhere that's no longer an option.