Deleted File Recovery

Deleted File Recovery

File recovery is an important part of the forensic process as well as a highly useful service for private computer owners. Data can be lost in a variety of ways, sometimes intentionally and sometimes not. DMS focuses on getting that data back in a responsible and accountable fashion.

Recovering Deleted Files

Files are deleted for a wide variety of reasons. For casual computer users, the most frequent scenario is deleting information that is deemed unneeded, only to find out later that it is critically important. These high stress situations can have serious repercussions in the work place, school, or private life. For serious computer forensics, files are frequently deleted on purpose on order to hide the perpetrators objectives and remove evidence of crimes.

Deleted files are interesting because once deleted they are not immediately removed from existence. Directory references are removed and the space they once occupied is free for overwrite, but the data is still in existence. As the space is taken up the original file becomes fragmented, but is still recoverable (sometimes fully, sometimes partially).

Recovering Damaged Data

Sometimes data is damaged through software or hardware malfunction. In these instances, files can be deleted or lost without direct action taken by the user.

Hardware crashes can occur in a variety of ways, including cd scratches, hard drive melting or disintegration, and physical impact. In these instances parts of the hardware can be carefully replaced to restore functionality.  Unfortunately if specific data is held on the damaged portion of the hardware the restore may not work. Disc imaging can also be used to replicate data that is still readable.

Non-physical damage can occur when specific files become corrupted or systems become compromised as a whole. Preventative measures like hard drive partitioning can help prevent total disaster, but even in those cases vital information is often at risk. Both Solid State Drives and Hard Disk Drives can attempt recovery, although the techniques tend to differ slightly.

Recovering Encrypted Data

Working with encrypted data is different than pure deleted file recovery. Encrypted data is often intact but hidden via encryptors of varying intensity. Forensic tools can be utilized to decipher the information depending on how deeply it is hidden.

Do You Need Data Recovery?

If you are a private citizen or an investigative institution that needs file recovery services, we can help. Reach out to us using our online consultation form or call 484-955-5664.