Getting acces to Canon Powershot A3100 internal data - General Help and Assistance on using CHDK stable releases - CHDK Forum
supplierdeeply

Getting acces to Canon Powershot A3100 internal data

  • 1 Replies
  • 1229 Views
Getting acces to Canon Powershot A3100 internal data
« on: 20 / September / 2012, 05:41:46 »
Advertisements
Hello everybody,

A sorry to start with, as this question is also posted in "releases", where it is not really correct I think.

I am a complete newby to this forum and to digital camera firmware in general. I am a forensic examiner specialising in cell-phones but, as you can image, camera's are used in crimes too....

I got a request from a police team to find out whether from a Canon Powershot A3100 it can be determined when cards were swapped.

The card that was found in the camera had some (lets say 5) file numbers missing, say IMG_0035.jpg through IMG_0039.jpg are missing, lower and higher files are there. Searching in different ways for deleted files on the card had no succes. One (plausible) theory is that another card has been inserted for a while, during which time the pictures IMG_0035.jpg through IMG_0039.jpg were taken.

Would it be possible to dive into the internal system memory of the camera and find data on the operation of the camera, let's say some log 'file', telling me that on a certain date/time the sd card was ejected/reinserted/formatted etc. I would be surprised if there arn't any system commands that can be sent to the camera to tell me more about it, but would there be something telling me about card operations.

Any help, hints, wild ideas are very welcome to allow investigation of the camera.

Thanks very much for your time,

UV

*

Offline reyalp

  • ******
  • 12214
Re: Getting acces to Canon Powershot A3100 internal data
« Reply #1 on: 20 / September / 2012, 23:24:49 »
I don't think the previous post was in the wrong forum. In general, if people have an answer they reply.
I got a request from a police team to find out whether from a Canon Powershot A3100 it can be determined when cards were swapped.
Why not ask Canon ? I'm sure they would cooperate with legitimate law enforcement requests.
Quote
Would it be possible to dive into the internal system memory of the camera and find data on the operation of the camera, let's say some log 'file', telling me that on a certain date/time the sd card was ejected/reinserted/formatted etc.
While Canon could tell you for sure, I don't believe anything like this is recorded on the camera itself.The only time the camera records a log to internal flash is when there is a serious error that causes the camera to shutdown.
Don't forget what the H stands for.

 

Related Topics