If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Forensic information requested.
Does anyone here have the following two pieces of information that I am
looking for? The first piece is dealing with the more indepth shutdown process and exactly when does the regeistry get closed during that process and the second peice is dealing with information in depth about the sectors and clusters use. I was told that the physical sector 96 displays the hex charature 07 when the system is not properly shut down. I would like to know if that is true and at what was terminated before that is written to the disk. I am working onb a case where I believe the soon to be exwife had planted infromation that would hurt him and the police may have lost some very valuable information as they siezed the computer. Can anyone help? |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Can get device information from Server end to Client end when do network printing? | roguekid | Printing | 0 | January 15th 06 02:01 PM |
System information | Faldo | General | 10 | October 28th 05 01:01 AM |
JCORE.DLL: invalid page fault error | Dobsons | General | 14 | August 5th 04 03:39 AM |
HARDWARE INFORMATION DATABASE | THAGEN | Software & Applications | 1 | May 9th 04 03:54 PM |
Win 95/98/ME - Information, tips, and techniques | Lefty | Improving Performance | 0 | May 7th 04 04:15 AM |