From EC Council materials: Consider using a hardware acquisition tool (such as UFED Ultimate or IM SOLO-4 G3 IT RUGGEDIZED) that can access the drive at the BIOS level to copy data in the Host Protected Area (HPA)
Can anyone elaborate on this? There's ton of evidence and reasons why to use a write-blocker, but very little I could find on specific files changed when mounting a drive to Windows.
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Elb
5 months, 2 weeks agovcloudpmp
2 years, 8 months agoAspiringScriptKiddie
2 years, 9 months ago