Technical Articles
Computer forensics is a part of data recovery industry that focuses not exactly on data recovery of all files, but mostly on search for evidence of all kind of crimes that were committed with use of a computer or other electronic device. What makes similar computer forensic service with data recovery service is search for deleted data. But in order to provide electronic evidence computer forensics also focuses on retrieval information not available to the typical user or system administrator, reconstruction of events in time, secure original medias as evidences.
The final product of computer forensics service is not only recovered data files, but also secure methods that makes the files to constitute them as an evidence in investigations. Like in case of "traditional" evidence e.g. fingerprints, also in case of electronic evidence it is carried some risk of their destruction during investigation. Example here would be seizure of original data or an interference with other data. When computer forensics experts would make wrong decision over evidence during data retention process, it would not only lead to make data unrecoverable but also make it invaluable as an evidence.
Each process of computer forensics is a collection of consecutive operations, that usage and implementation guarantees that evidence media was provided to law enforcement authorities by investigators as fully probative and valuable evidence. Any mistake done at any level of investigation may lead not only to loss of critical data, but also the evidence may be rejected by the court.
The most common carriers of electronic evidence – medias that were investigated and in most cases used as evidence, were personal computers hard disk drives, that was about 61.5%. Second group of medias were server hard disk drives and RAID arrays – those were about 20% in summary. In details: 7% of all medias were mail servers hard drives and RAIDs, and 13% were other servers e.g. cameras monitoring the streets, hard drives and RAIDs. Another groups of media investigated by computer forensics were: CD and DVD - 8.5%, electronic notebooks memory devices – 3% (mikro drives, 2.5" hard drives, solid state disks), portable memory devices - 2.5%, telephones – 2.5%, and diskettes – 2% (ZIP media, Jazz media, floppy disks).
Some of our recent Data Recovery Cutomers
