Forensic Logging Option for MediaMerge/PC
The Forensic Logging Option in MediaMerge/PC was developed in response to feedback from our many clients within the Computer Forensics community. This option allows you to do a directory and file listing of a tape without having to restore the tape to disk. The Forensic Log includes the file names and other associated meta-data (access, creation & modification dates, file size, etc.). This information is output on a file-by-file, line-by-line basis to a central location on disk in MM/PC where it can later be exported for further examination to the database of your choice.
Because some tapes have upwards of 200Gb of data and 400,000 files, logging the tape first and then selectively restoring only the files you want saves you a huge amount of time, disk space, and money. The files are listed by number, and you can use this file number as your key during the restoration process. When combined with the Automatic Running Option you can tell MM/PC what file types you are interested in logging and to produce a log containing only these selected file types.
Using both the Forensic Logging option and the Automatic Running option, it is possible to obtain a complete snap shot of a computer at any given time and date. Subsequent file changes or deletions can then be determined by comparing with later or earlier back up tapes.