BIOS limitations issues during computer forensic examintations
- Log in to post comments
Computer Forensics Expert Note: Sometimes, while performing a computer forensics analysis, BIOS limitations may limit the computer forensics examiners ability to make a bootable bitstream copy. Additionally, these BIOS limitations may make it impossible to be able to access all the partitions on the drive. To minimize these problems, the computer forensics examiner must make sure to:
Set the BIOS on the examination machine to allow for both manual and auto detect drive parameters.
Make sure that the BIOS on the examination machine can recognize large hard drives without the need for a BIOS overlay.
Always use a drive in the same size range to make a copy of a drive to reduce the possibility that a different translation scheme will cause the copy to be inaccessible or not bootable.
This computer forensics information is presented by AVM Technology, LLC, a Computer Forensics, E-Discovery, and Computer Security consulting company located in Richmond, VA and serving clients throughout the United States.