Great presentation! Windows and devices are full of oddities - msinfo32 tracks starting at Partition 0 while diskpart starts at partition 1, some drive docks add 4kn sector emulation instead of just being passthrough - regardless of whether the disk is 512, 512e, or 4kn, and basically anything other than hdparm lies to you about serial numbers - especially if going thru an adapter.
@ML-lg5zw
8 ай бұрын
More folks in DFIR need to watch this video and learn about this!
@yanuriroschev7270
Жыл бұрын
Kevin Ripa is a great SANS instructor!
@AndrewColemanNetEng
8 ай бұрын
If you look in Linux the serial# are clear. Windoz...
Пікірлер: 4