[Case Study] WhatsApp Forensics:Decryption of Encrypted Databases and Extraction of Deleted Messages


[News] First SalvationDATA Tech Championship


[Software Update] VIP V1.0.15.7996 New Version Release for Better DVR Forensics


[Event] SalvationDATA WhatsApp Forensics Free Tool Release Webinar

[Software Update] Forensic Data Recovery Tool DRS V17.7.3.268 Available with More Capabilities

We're excited to announce today that new version of Forensic Data Recovery Tool DRS is available for update. Update to the latest version now to explore its new capabilities. Some of the new features added include: 1. Muti-tasking is now online! Supporting up to 4 DRS process running simultaneously. 2. New imaging input and output format: E01, AFF. 3. New HASH calculation tool in tool box, supporting MD5, SHA1, SHA256 algorithm for files or strings. 4. Multiple bug fix, system optimizing.


[Technical Article] Recover Data from Encrypted External Hard Drive (USB Port)

This issue covers the forth technique application case study conducted by SalvationDATA technicians — data recovery through the opening of a WD 1TB external hard drive. The hard drive involved in this case study was badly scratched and double-secured (hard drive firmware encryption + USB firmware encryption), which makes this case study a typical one. Recovering data from this hard drive is quite different and much more difficult, because normal hard drives can generate image file and access data after changing the magnetic head, but this one cannot. To recover data from the double-secured hard drive with USB port, we needed to have its circuit board changed twice and obtain the key for decrypting the hard drive through initiating WDunlocker by simulating data needed for decryption. No data can be recovered from the image file of said hard drive unless the hard drive is decrypted.


[Technical Article] SalvationDATA Helps Reveal Truth of a Fatal Crash

Driver of a Honda died after a head-on collision with a truck and, with no camera around that remote area, automobile data recorder of the Honda is the key for identifying the cause and liability of the accident. When police retrieved data from the recorder, however, the last-minute record is missing. What’s the truth then?


[News] SalvationDATA at Techno Security & Digital Forensics Conference!

It needs no reaffirmation that Techno Security & Digital Forensics Conference is one of the most important resources for corporate network security professionals, federal, state and local law enforcement digital forensic specialists, and cyber security industry leaders from around the world. Attending the event not only helps professionals gain deeper insight into digital forensics, but also enables companies to network with resources around the globe. And we’re sure that SalvationDATA is one of the resources that can help you out of your forensic conundrums at Techno Security & Digital Forensics Conference.


[Technical Insights] Find Who's Behind Unsanctioned Flight of UAV

Recent years have seen a marked shift of Unmanned Aerial Vehicle (UAV) from an expensive and professional production equipment to a consumer product. And, along with this shift comes more unsanctioned flights which have major impacts on the safety of traditional aircrafts and human life. Unsanctioned flights of four UAVs occurred at Chengdu Shuangliu International Airport at the night of April 21st, for example, caused alternate landing of 58 flights at Xi’an, Chongqing, Guiyang, and Mianyang airports, 4 flight returns, and the stranding of more than 10,000 passsengers. Prior to this event, on the 14th, 17th, and 18th, unauthorized flights of UAV also disturbed the normal arrangement of Shuangliu airport when they caused alternate landing and delay of flights.


[Technical Article] Mac Log File Structure and Extraction Analysis

When it comes to computer forensics, the capability to extract and analyse Mac log is very essential. Since Mac log file cannot be recognized on window system, its structure needs to be parsed so that we can proceed further analysis. In this issue, data recovery experts from the Key Laboratory of Sichuan Province introduce the structure of Mac log files, and how to use the SalvationDATA (DF)Digital Forensics System for its analysis and extraction.


[Software Update] DRS V17.7.3.263 Available Now with More Capabilities

We have been optimizing our computer forensics software, DRS(Data Recovery System) every day to help investigators recover and extract more evidentiary data from various kinds of hard drives. Let’s see the newly added features in V17.7.3.263.


[Software Update] New SPFV3.54.7.0 Allows Access to More Evidentiary Data

We’re excited to announce the release of the latest update of SPF(SmartPhone Forensic System). The newest release allows users to get access to more evidentiary data and fixed bugs of previous version. What’s new?


[News] Successful Forensic Training with Delegates from Malaysia

From 15 May to 25 May, delegates from a Malaysian forensic laboratory came to SalvationDATA for training. The training, as customized for their specific requirements, covered a wide range of topics concerning computer, mobile and DVR forensics, which not only acquainted them with necessary basic knowledge, but also equipped them with essential skills of doing digital forensics with SalvationDATA forensic products, i.e. DRS(Data Recovery System), SPF(SmartPhone Forensic Sytem) and VIP(Video Investigation Portable).


[Technical Insights] How to Decrypt BIOS Encrypted Hitachi Hard Drive

In this issue, data recovery experts from the Key Laboratory of Sichuan Province will introduce fast decryption methods for BIOS encrypted Hitachi hard drive. This method, compared with other commonly used methods, features simple operation, simplified process and high success rate, and can be used to help onsite forensic experts to quickly extract important clues.