User manual

Cypher Technology Ltd 2008
17
5.1.4 File un-deletion
When a file is deleted the actual file data is normally left unchanged on the storage
device. The deletion involves marking the file name in the file table to show that the file
is no longer required and that the data space that was being used on the card can be
used for new files. Because of this, if no further data is written to the card, the original
deleted file may be retrieved or “un-deleted”. The Master Copy allows for un-deletion of
files where it was possible on the Flash card. (See “How is the Master Copy used?”
above). The Working Copy, of course, will not contain deleted files.
5.1.5 Historical file data
When a file is copied from the Flash card to another storage device (as with the
Working Copy) information about its creation may be lost. Most obviously this may
include the original modification and creation times from the Flash file table but also
more subtle historical information may be lost relating to the media history.
5.1.6 Media History
When a file is created on a blank piece of media, the storage space is generally
allocated from the beginning of the data area. Once several files have been created and
then a few have been deleted “holes” appear on the file data area where the old file
data resided. These holes will eventually be overwritten with new file data as new files
are created, but because these new files may be of different sizes to the old files, one
new file may have its data spread across the disk at various locations. The more a
Flash card or drive is used, the more fragmented it becomes. This gives valuable
information about the use of the media and the time of creation or modification of a file.
The Master Copy preserves all this information as it provides an exact snapshot
of the state of the card when the copy is taken and because it leaves all the card
data unchanged within the backup. The Master Copy is therefore the most
important evidential backup.
5.2 Disk Verify Read
Most backup programs simply copy the data to the backup medium and assume it has
been written correctly and can be re-read. With optical disks this is particularly
dangerous. PUMA dramatically reduces the chance of producing unreadable disks by
performing a verify read of the disk after it has been written. The verify pass itself,
involves re-reading every data bit from the Flash card and checking it against every bit
in the flash.img file.
5.3 Working Copy (file copy)
The Working Copy is a full copy of the directory tree of the Flash card or USB drive.
This means all files and directories are copied. Any file types can be copied. It provides
a function similar to conventional backup software.
For the files on the Flash card to be recognised by PUMA, the card must be formatted
with a FAT16 or FAT32 file system. The Working Copy disk uses an ISO9660 filing
system and is recognised by most computing platforms. The system also implements
the Joliet extension to the ISO 9660 standard which allows for long file names.