PC / Mobile Forensics
Most people think that when a certain file or files are deleted it is
permanently removed from your computer. Files still remains on your disk and
still recoverable even if it’s deleted, formatted or damaged so when there are
files needed let’s say as a part of an investigation a computer forensic analyst
got the knowledge and the necessary tools to find them.
The average computer user believes that by just pressing “Delete” the files
are gone for good they don’t see the potential evidence that are still kept on
their disk. All files that are deleted are still very much possible to recover
provided that it is not overwritten. Files that are deleted are just relocated
in what we call the “non-live” areas of a disk.
These are also called
'unallocated clusters' that can hold gigabytes of deleted data.
Computer Analysis are done by highly qualified and skilled practitioners.
These people fully understands the science of recovering valuable informations,
which can be used as a vital part within a court case.
Depending on the files or data that are still on the disk, these forensic
experts can still find lots of valuable information about it’s background. For
instance, they can even tell the username or login name when the files are
deleted including it’s date and time when the removal occurred.
Some people
sometimes tries to disguise criminal data under a different filenames and
extensions but those tricks is not effective to Forensic analysts. They have the
tools and proper procedure to see those harmful files even if its hidden or
cloaked as something else.
Do you know that even passwords are not enough to keep forensic experts out
of your files? forensics have tools to break even the hardest and encrypted
passwords.
No matter how secure your password is forensics can still find ways
to break into that file and acquire any important data.
Files that have been corrupted are still possible to be retrieved. Even if
the forensics can’t retrieved the whole data a partial recover is enough to be
used as a vital evidence against a suspect.
The science of computer analysis takes time, patience and dedication.
Forensic experts has all the knowledge and tools to check and to know anything
has been inputted onto the computer and they can see everything on a hard drive
regardless of whether the all files disk has been deleted or
corrupted.
