NTI - Computer Forensics Processing Tips

Processing Photo Digital Memory Cards

NTI's Graphics File Extractor was designed to accurately reconstruct deleted graphic image files. It was primarily created for use by law enforcement computer crime specialists and corporate security specialists in the identification and reconstruction of deleted pornographic image files on computer hard disk drives. However, one of our clients pointed out to us that it also is a good tool for use in investigations which involve digital camera flash memory cards. The quote from the client explains the process and it follows:

"I want to thank you for some great software. I just bought gextract.exe because the last time I needed this facility I had to go to the FBI for it. No sooner had the software arrived when I had a user accidentally delete all the photos from a 32MB flash memory module from his digital camera. He was devastated since all of the photos from his recent trip were gone, gone, gone!"

"I mounted the memory module on my PC as the F:\ drive, did a WinHex backup of the drive into a .whx file, ran gextract.exe against that file and viola! The 109 lost .jpg photos were quickly restored. This is not exactly the intended use of the software, but we have a very happy customer. I have now let my photographic department, and public affairs office know that should they accidentally delete photos that they need, that I am a resource they don't want to ignore."

Previously deleted graphics files can also be restored from flash memory cards by using Graphics File Extractor in combination with NTI's GetFree software. This is accomplished by mounting the flash memory card using a USB or parallel port flash memory card reader, e.g., the Memorex USB CompactFlash Card Reader. Once the drive is mounted the unallocated file space can be captured in DOS or in a Windows DOS box using GetFree. When this is done the output file should be directed to a separate computer storage device rather than the subject flash memory card. The output file can then be quickly processed using Graphics File Extractor to recover all of the deleted GIF and JPG files.

Back To NTI's Home Page