Recovering deleted data

From ForensicsWiki
Revision as of 17:21, 29 October 2005 by Jessek (Talk | contribs) (Initial description)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

When the user requests to delete a file, most modern operating systems don't really delete the information. That is, although some information is changed, the data often remains on the original media. For example Microsoft Windows alters the directory information for the data, but not the data itself.

Recovery Programs

There are many programs that can recover these deleted files, some specifically designed for forensics purposes, some not. For example, Scalpel and it's predecessor foremost were developed with forensics in mind, while others like Norton Unerase was not.