Hello everybody,
I am a complete newby to this forum and to digital camera firmware in general. I am a forensic examiner specialising in cell-phones but, as you can image, camera's are used in crimes too....
I got a request from a police team to find out whether from a Canon Powershot A3100 it can be determined when cards were swapped.
The card that was found in the camera had some (lets say 5) file numbers missing, say IMG_0035.jpg through IMG_0039.jpg are missing, lower and higher files are there. Searching in different ways for deleted files on the card had no succes. One (plausible) theory is that another card has been inserted for a while, during which time the pictures IMG_0035.jpg through IMG_0039.jpg were taken.
Would it be possible to dive into the internal system memory of the camera and find data on the operation of the camera, let's say some log 'file', telling me that on a certain date/time the sd card was ejected/reinserted/formatted etc. I would be surprised if there arn't any system commands that can be sent to the camera to tell me more about it, but would there be something telling me about card operations.
Any help, hints, wild ideas are very welcome to allow investigation of the camera.
Thanks very much for your time,
UV
