Get the latest e-discovery and computer forensics news in one place.

Sign up for the monthly JD&A Newsletter today!






BRJDEV Forensic Duplication Corruption PDF Print E-mail
The forensic duplication for the BRJDEV computer system in the BRJ Software
scenario will not work from the DVD. The forensic duplication contains zeros
from byte 139,038,720 to the end of the file. The problem can be fixed by
downloading a patch file from http://www.jonesdykstra.com/files/patch0001.bin.
The patch can be applied to the original file copied from the DVD with the following
command:

dd if=patch0001.bin of=BRJDEV.dd.gz bs=512 seek=271560

The output of the command above, BRJDEV.dd.gz, will have the following MD5
hash if it has beed successfully patched:

3f274b39803068d69f8b62730e101d64

The "dd" command can be found in nearly any Unix installation and in Windows
after Cygwin (www.cygwin.com ) has been installed.