Cypher Technology Ltd V2.6 (03) December 2011
14
4.5
How is the Master Copy used?
4.5.1
PUMA Master – The ultimate evidential exhibit
Copying Master digital evidence files from a flash card to a CD or DVD by
“dragging and dropping” on a PC will leave behind deleted files and other meta
data. Simple card copiers only copy the undeleted, un-hidden files. Both these
practises leave the Master exhibit open to costly legal challenge.
The PUMA Master contains all the data from the flash card on a write-once optical disk.
This includes the files, deleted files, the file system, partition information and all
historical file data. As such it provides the most secure, evidential backup and allows
the most complete evidential audit trail. It contains everything that was on the flash card
and as such can be used to generate a clone of the original card.
It has the advantage over the original flash card in that the data cannot be altered,
accidentally or otherwise. Simply inserting a flash card into a computer and opening a
file will change the data on the card and therefore the evidence. Vital date stamp
information can be changed.
Optical disks are also immune to static.
There are two possible formats for the Master. Full Image Master and Compact Master.
Both Master disks can be restored back to a card to access the files.
With a Compact Master the files can be accessed directly from the Master disk “Files”
folder. This will not be the case if the original card was corrupted.
4.5.2
Accessing the Full Image Master Copy with WinImage
Firstly, the flash.img file on the Master Copy disk can be opened with a disk image
viewer program. Such a program is WinImage, a trial version of which may be
downloaded from:
http://www.winimage.com/download.htm
Fig 3. Winimage screen display under Windows XP