Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Lexmark 646e Printer Hard Drive

Posted on 2013-01-09
2
Medium Priority
?
668 Views
Last Modified: 2013-01-14
All~

Need to begin foreinsics on a a printer hard drive (Lexmark 646e) - does anyone know, before I pull the drive, what the file system on the hard drive will be (FAT32, HPFS, NTFS?) and will it be readable on widows from a disk enclosure?

Thanks in adavance.
0
Comment
Question by:JakeBanzai
2 Comments
 
LVL 88

Expert Comment

by:rindi
ID: 38763057
It will most likely use a Linux or BSD file-system, and not anything m$ or Apple based, as devices like that usually use a Linux or BSD type OS.

I suggest using the PartedMagic LiveCD to boot your PC with and the printer's disk attached. Then open the Partition Editor on that CD's desktop. It should tell you what filesystems it uses. If the disk is OK you should then be able to mount the partitions on that disk and read the data, or with testdisk/photorec (both utilities on that CD) you can scan it and recover data:

http://partedmagic.com
0
 
LVL 65

Accepted Solution

by:
btan earned 2000 total points
ID: 38766883
This is an MFP and support HDD encryption and wiping. If either are on or done, forensic will not be revealing much and of low value since they are performing more than formatting. Currently hard disk encryption and hard disk wiping are not default settings for Lexmark devices.

http://www1.lexmark.com/en_US/solutions/business-solutions/security/hard-disk-capability.shtml

No specific file system I can guess unless we do a fingerprinting on it. But I saw in lexmark paper though not targeting this MFP on the paper

"Note that this does not render the hard disk drive useless. When an encrypted hard disk is moved from one MFP to another, it must be reformatted when it is placed into the new MFP. The hard disk is portable, but the data on it is not"

"Briefly, however, there is no means by which to have the MFP reprint or retrieve residual data as the MFP does not support a network file system or file sharing. Further, there is no protocol supported by the MFP that allows someone to arbitrarily read or write data to or from the hard disk. Even without encryption of the disk’s data, the contents are well protected."

However, although this is not Lexmark, may worth a quick read on this as well - they are using encase - Forensic analysis of digital copiers (Xerox DC432ST and Canon iR 2200)
http://www.willassen.no/svein/pub/copier-en.pdf
0

Featured Post

Lessons on Wi-Fi & Recommendations on KRACK

Simplicity and security can be a difficult  balance for any business to tackle. Join us on December 6th for a look at your company's biggest security gap. We will also address the most recent attack, "KRACK" and provide recommendations on how to secure your Wi-Fi network today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This seems to be a very common error related to the Samsung printer driver. First, this is the error we're talking about: Log: System Type: Error Event: 7000 Agent Time: 3:37:24 am 22-Apr-09 Event Time: 6:07:24 pm 21-Apr-09 UTC Source: Se…
The foremost challenge encountered by an investigator at the very beginning of a forensics investigation is, accessing a file/data to read/view its contents. Owing to the fact, a platform is necessary for both; opening as well as examining any file.…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …

783 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question