Computer Forensic Analysis

The scope of a forensic analysis can vary from simple information retrieval to reconstructing a series of events.

Information retrieval is a process of salvaging (retrieving) inaccessible, lost, corrupted, damaged or formatted data from secondary storage, removable media or files, when the data stored in them cannot be accessed in a usual way.

The data is most often salvaged from storage media such as internal or external hard disk drives, solid-state drives, USB flash drives, magnetic tapes, CDs, DVDs, RAID subsystems, and other electronic devices.

Recovery may be required due to physical damage to the storage devices or logical damage to the file system that prevents it from being mounted by the host operating system.

The most common data recovery scenario involves an operating system failure, malfunction of a storage device, logical failure of storage devices, accidental damage or deletion, etc., in which case the ultimate goal is simply to copy all important files from the damaged media to another new drive.

Another scenario involves a drive-level failure, such as a compromised file system or drive partition, or a hard disk drive failure. In any of these cases, the data is not easily read from the media devices. Solutions range from repairing the logical file system, partition table or master boot record, to hardware replacement on a physically damaged drive which allows for extraction of data to a new drive. If a drive recovery is necessary, the drive itself has typically failed permanently, and the focus is on a one-time recovery, salvaging any data that can be read.

In a third scenario, files have been accidentally “deleted” from a storage medium by the users. Typically, the contents of deleted files are not removed immediately from the physical drive; instead, references to them in the directory structure are removed, and thereafter space the deleted data occupy is made available for later data overwriting. Deleted files cannot be found through a standard file manager, but the deleted data still technically exists on the physical drive and may be recoverable if not overwritten by other data files.

The term “data recovery” is also used in the context of forensic applications or espionage, where data that has been encrypted or hidden, rather than damaged, is recovered. Sometimes data present in the computer gets encrypted or hidden due to reasons like virus attack which can only be recovered by computer forensic experts.

Your computers hard drive, specifically the data it contains, is probably the most valuable item inside of the machine… and also one of the most prone to disaster!

My Computer Forensic Services include –

Hard Drive Data Recovery
Description Coming Soon.
Deleted Files Recovery
Description Coming Soon.

CONTACT ME today!

SHARE THIS PAGE OR POST

Consulting Services with YOUR bottom line as our 1st priority!