The Process of Recovering Deleted Data
The process of correctly recovering lost data from a hard drive can be a painstaking process. It involves the acquisition, preservation, analysis and presentation of digital evidence.

In order to create a highly defensible case, it is important to utilize a qualified forensic expert who has been properly trained in forensic methodology and technique. It's one thing to simply recover data, it's entirely another to have the evidence uncovered stand up in court.

We fully comply with the strict standards set out by the International Association of Computer Investigative Specialists (I.A.C.I.S.). These standards are the same employed by top law enforcement such as the FBI, CIA and electronic crime task forces.

What types computer forensic software tools do we use? There are pros and cons to different hard drive recovery software packages and for this reason we do not rely solely on a single tool. Primarily we employ Encase by Guidance Software. Encase as a forensic examination tool has been validated by numerous trial and appellate court rulings.

It has become the de facto standard and is used by many government organizations including the FBI. Because it is the nature of Windows to write to the hard drive while booting up, we sometimes employ DOS tools when performing a hard drive recovery. Software packages for forensic recovery come in many different flavors and we find that a combination of tools, utilized strategically, yields the best results.

In the course of many forensic computer investigations we have found that automated hard drive recovery software tools like EnCase cannot always uncover all key information. For example password-protected files require additional specialized techniques and recovery tools such as Access Data's Password Recovery Toolkit. Corrupted files also require special care and handling with specialized software. For this reason we employ a 'toolkit' of hard drive recovery software and related utilities that help us recover almost any file type.

Key to the process of forensically sound file recovery is:

• Correct and consistent use of forensic software
• Implementation of a consistent process that acquires evidence without any alteration or destruction
• Creation of a detailed, accurate report which can withstand legal scrutiny

A consistent investigative methodology, combined with proper hardware and software tools, followed up with clear, understandable reports is the best way to obtain quality results time and time again.