Abstract
Many modern digital copiers store copied and printed information on internal hard drives. Such information may have value as evidence. In order to test the possiblities for evidence extraction from copiers, two digital copiers containing hard drives were dismantled and forensically analyzed. The analysis shows that it is possible to retrieve exact copies of documents that has previously been copied and/or printed on digital copiers. The analysis method is evaluated and found to be applicable on most digital copiers containing hard drives, unless special precautions have been taken to protect the stored material. The ability to retrieve documents that have previously been printed or copied on digital copiers is valuable within forensics, but also raises new questions within information security.
By : Svein Yngvar Willassen, M.Sc,
Download Link :
