Hard drive forensics and data recovery
June 7, 2010 3:18 PM Subscribe
I am doing a research project for my CS degree and am looking at how to present an example for the class of forensic type data recovery. Say for example a company had files they didn't investigators to find out about and they deleted them. What tools would/should I use to prove that they have deleted them?
posted by l2yangop to Computers & Internet (3 answers total)
So far i have decided that I would first start with a hard disk image that I would put on a usb key, and follow that up with some type of file recovery scanning software (any suggestions?). I would then check the event logs for file deletion (is that possible?). Would it be necessary to get a bit by bit clone copy of the hard drive itself? if that is the case would i need an identical hard drive/system setup to access it later?
Any help that you can provide would be most appreciated as i feel in the dark on this a little.