Top tip:

Don't buy one of those multi-disk USB caddy thingies that you put bare disks into.

If you do, don't get one with a convenient one-press disk-to-disk copy button.

If you do, don't forget the presence & purpose of that button.

If you do, don't use the caddy as a long term home for drives that really want to be inside a case.

If you do, don't one day change up your USB hub and then wonder why the disks in your caddy aren't visible.

While diagnosing the problem, don't idly reach around the caddy and feel the button and wonder whether it's some sort of reset.

When a quick press of the button does nothing, don't remember that some reset buttons need a longer press to demonstrate your sincerity.

When a long press starts all sorts of activity on the caddy's LEDs, don't celebrate and think "that looks pretty resetty, wonder when the drives will register".

DO have a consolatory fifth of gin handy for when you:
a) realise the reset is taking a little long, and
b) shudder as you finally remember the true purpose of that button.

Unrelated: I'm not optimistic but I'm in the market for some disk forensic/recovery software/advice.

#DiskForensics #disaster #recovery #DataRecovery #YesIAmAPillock

Windows Shell Items Analysis: https://blog.cyber5w.com/shell_item_analysis

#DiskForensics

When you need to capture a #BitLocker driver you might be able to sniff the key from the TPM.

Take a look at the full video on this process. It contains some great research & simple hardware he built for it.
https://youtu.be/wTl4vEednkQ

#DFIR #IncidnetResponse #DiskForensics