How to Perform Computer Forensics and Data Recovery

The topics of computer forensics and data recovery go hand in hand. In fact, a large portion of computer forensics is centered on recovering data that has been removed from computer hard drives, either by physical damage or by being intentionally deleted. The key is in understanding that data is not truly deleted from the computer's hard drive. The space where the data is stored is marked as available for use by the system, but until something new is placed in that space, the old files are still intact and capable of being recovered. That is where computer forensics comes into the picture. Continue reading to learn how to use data recovery software to perform your own computer forensics.

Difficulty: Moderate

Instructions

Things You'll Need:

• Data recovery software
• Ethernet cable
• High capacity storage device

1. Select a data recovery software program, and install it on the computer that will be used to analyze the suspect computer. There are a number of products available on the market. One of the more popular options is Ibas Data Recovery, which is used by computer forensics professionals around the world. A link to this product can be found in the Resources section below.

2. Connect the computers together. Use an ethernet network cable or a USB cable to connect the computer being analyzed to the computer that contains the data recovery software. This will allow you to perform the computer forensics on a separate computer, without compromising the available disk space on the suspect computer.

3. Launch the data recovery program. During the installation process, the data recovery software will place an icon on the computer desktop. Double-click on this icon to open the data recovery program. You can also click the "Start" button, and navigate to your programs list to find the software.

4. Select the drive of the computer to be analyzed. As the computer forensics process begins, the data recovery software will prompt you to select which drives you wish to scan and recover. Select the hard drive of the computer you wish to analyze. The recovery software will first catalog which files and folders are already active on the computer, then it will read other sectors to locate and identify files and folders that have previously been deleted. The software will also ask which of these items you would like to recover and view.

5. Save a copy of the hard drive after the restoring process is complete. Depending on how much data was found on the hard drive, you will probably need to use a high capacity storage device to retain a copy of the information. There are a number of portable hard drives that can be used to hold a duplicate copy of the suspect hard drive after you finish performing the computer forensics.

Tips & Warnings

• Always avoid installing the data recovery software directly onto the computer you wish to analyze. The software will use some of the hard drive space that is marked as free, and could potentially overwrite the very files you want to identify and access.

Resources

• Ibas Data Recovery Software