Chapter 4: Data Recovery

---

OVERVIEW

Computers systems may crash. Files may be accidentally deleted. Disks may accidentally be reformatted. Computer viruses may corrupt files. Files may be accidentally overwritten. Disgruntled employees may try to destroy your files. All of these can lead to the loss of your critical data. You may think it’s lost forever, but you should employ the latest tools and techniques to recover your data.

In many instances, the data cannot be found using the limited software tools available to most users. The advanced tools that you utilize should allow us to find your files and restore them for your use. In those instances where the files have been irreparably damaged, your computer forensics expertise should allow you to recover even the smallest remaining fragments.

With this in mind, data recovery is, of course, of potential interest to anyone who has lost data to the ravages of time, malice, or carelessness. But in forensic computing or analysis, it takes on a new meaning—suddenly what other people have thrown away can become an important component in understanding what has happened in the past, as burglary tools, data files, correspondence, and other clues can be left behind by interlopers.

This chapter covers the ins and outs of data recovery as it relates to computer forensics. But, before delving into the ins and outs, what is data recovery?

---