What is Computer Forensics?
Forensic Data Recovery or Computer forensics, is the collection, preservation, analysis, and presentation of computer-related evidence. Computer evidence can be useful in criminal cases, civil litigation, and human resource and employment proceedings.
Far more information is retained in a computer than most people realize. It’s also more difficult to completely remove information than is generally thought. For these reasons, as well as others, computer forensic examinations can typically recover lost or deleted information (or at a minimum, find evidence of the information) even when it has been intentionally deleted.
Forensic examinations of a computer hard drive go far beyond normal recovery techniques, probing areas and files on the media not normally accessed by untrained personnel. These examinations can locate whatever data a business, agency, or individual needs.
Who needs Forensic hard drive recovery anyway?
We have assisted law enforcement agencies, law firms, private investigators, government agencies, and human resources departments and private individuals throughout the country.
In this day and age, corporate sabotage and communications, infidelity, pornography, and numerous other situations in which a forensic recovery is required happen more often than ever. This is when we are called upon to perform an investigation.
Here is a brief list of what is possible:
- Recovery of deleted hard drive files
- Data recovery even after a hard drive has been reformatted or repartitioned
- Damaged and encrypted hard drives can be decrypted (with key)
- Determination of web sites that have been visited
- Determination of what files have been downloaded
- Determination of when files were last accessed
- Discovery of faxes sent or received on a computer
- Discovery of email messages and attachments even if previously deleted
- Recovery of financial records and other documents
We can recover and preserve data forensically from most media types and operating systems.