
Cypher Technology Ltd V2.6 (03) December 2011
16
Fig 6. ImageMaker final screen
The Checksum shown at the end should be the same as the checksum noted down
during the making of the Master.
This single .img file can be accessed by WinImage in the normal way.
4.5.4
Restore the Image Back to a Card
Secondly, the disk image can be copied back to a flash card of equal or greater size
than the flash.img file (and therefore the original flash card). This copied flash card will
behave as an exact clone of the original allowing, for example, the un-erasing of files
and the forensic examination of file allocation addresses and access dates. On PUMA
this task is performed by the Restore Master function (see Section 4.4.10).
5 Technical Background
5.1
Master Copy (bit for bit copy)
The PUMA Master Copy stores all the all of the data on the flash card and is therefore
evidentially equivalent to the original flash card. Because the whole of the card is
copied, the Master includes hidden files, deleted files, historical file data fragments,
original time-accessed and time-modified data, the filing system (FAT), and the boot
sector and partition information.
As such it provides the most secure, evidential backup and allows the most complete
evidential audit trail. It contains everything that was on the flash card and is the same
size (in Kbytes) as the flash card.
There are two formats for the Master