New
#1
How to provide evidence a hard disk has been recovered in Windows?
CIP regulations are requesting proof that a hard drive has been recovered to prove a recovery process has been completed. I am not sure why that matters as we have proof we ran the recovery process, but they want proof that the drive is a "recovered" drive. I have no idea if that is possible since a recovered drive is identical in every way with the exception of the drive ID. The want more than that, which makes no sence but we are trying here.
Any ideas on if there are any identifying factors in the image on the drive that proves it was a recovered drive?
We use both Windows backup and Macrium. To my knowledge neither one has an "identifier" on the local drive to show it was created from an image?
Thanks for any help here. We can't use any other product either, strictly restricted lol.