how is the FBI able to recover evidence from computer hard drives, even after the file has been erased/deleted

Answer 1

When you hit "Delete" it only actually deletes the first "character" [about 8 bits]off the header of the string of binary numbers that make up what you THINK you are deleting, making it invisible to your hard-drive's "F.A.T.", which stands for File-Allocation-Table....um, which in HUMAN terms is a book's equivalent of a "T.O.C." Table-Of-Contents. [techies LOVE cryptic acronyms.] all this does is make the rest of that data invisible to your Operating System, which can then re-use that cluster of space on your harddrive if it later wants to. Your harddrive has a TINY magnet on an arm similar to an oldschool D.J.'s turntable, that writes fragmented data-bits everywhere & is able to quickly find & reassemble those bits into the data it needs at fast-as-lightning speeds. ...well... as you continue using your harddrive, it doesnt always cover over top of the old "Deleted" info with the NEW info. THUS, half-baked, incompletely deleted, O.S.-invisible number clusters can be viewed & often RECOVERED, using forensic "HEX" editor tools. "Hex" is short for hexidecimal, a CRAZY number system that uses 16 place values instead of the 10 most human beings learn about in kindergarten. [..."Binary" uses only 2] ...b-bla b-bla bla blah.... ANYWAY...
Delete doesnt really delete, it just destroy's the data's header, so it cant be seen anymore by your Operating System without using special DATA RECOVERY software like Hex editors & sensitive hard&soft-ware tools capable of TOTALLY BYPASSING the FAT & lifting binary frags directly off the spinning magnetized platter.
Department of Defense nukes their obsolete data with stuff like "B.C.wipe" to totally kill ALL fragments that comprise a complete string of any data they want to REALLY delete. it wipes data with multiple & massively-redundant erase-passes that surgically perform effective low level formatting on that piece of info, reducing ALL those little ones & zeros to nothing but untraceable zeroes. [for experts ONLY! use with EXTREME caution! Shift+LeftClick this to download it in a different window] http://www.jetico.com/index.htm#/bcwipe.htm
...it's ALSO how CONGRESSMEN get away with murder.
WARNING: do NOT watch this next clip if you cannot handle the TRUTH, but turn on, up, plug in, or get some speakers first.
then Shift+LeftClick here: http://allan.imeem.com/video/HRvjy2ij

...whew !
hope that was easy enough to understand,
& i hope your teacher likes my report =)
= Hulksmaash !

Answer 2

Theoretically, there really is not a way to completely delete a file from a hard drive. Degaussing (use of a large magnet) does the most but even that is not complete. Generally speaking, a computer lays files down on tracks. When you delete a file more like than not that file exist mixed up with other files. All the computer does is say that this disk is capable for being used. However, it does not necessarily use that space and almost never uses every track that was deleted for a file (especially large files). There are software programs that will read the surface of a disk and recreate all the ones and zeros it finds.

Answer 3

when a file is stored on a hard drive, it is stored in two parts. The data and the file header. The file header contains information about the file, like what kind of file, where it is, how big it is, etc. When you delete a file, only the header is deleted. The space the file occupies is just freed up for other use. therefore, with special software, this data can be recovered.

Answer 4

If you erase a file from recycle bin all that happens is the first character if the name gets removed - so picture.jpg becomes
" "icture.jpg (blank character) The operating system ignore this file by not including it on the map (FAT) so the next files write over the top of it randomly. Files are many time scattered about the HD (fragmented). The sooner one gets to the hard drive to do a recovery with a data recovery program the better the chance of a full recovery of that data.

Answer 5

When a file is deleted from your computer, its name and apparent prescence is removed but the data is not removed until it is overwritten sufficiently. Therefore you must "wipe" the clear space on your drive in order to cover this remaining data. There is software all over the internet which does this to varying degrees. Go with a DoD (dept of defense) level over-writing program and dont forget there are many other tracks which can be found other than just deleted files.

Answer 6

Through computer forensics. When you delete a file, you don't really delete it, you break the pointer to that file so that it doesn't get picked up in your search. When you format a hard drive, youu basically blow up the FAT(File allocation table). FBI uses softwares to put the FAT back together.

Answer 7

Deleting or erasing a hard drive doesn't actually erase your files on the magnetic drive, it just flag for an available space to write. They can be easily undelete. Format is what you want to do to totally erase all the information on your hardrive(I think).

Answer 8

When something is delete off of a hard drive in actuality it is really not deleted. there are pointer to where it is that are deleted. and with the pointers deleted the computer will write there later when it needs to. until then though the data is still there. it is like taking a building that has every room number and only removing the numbers the rooms and building are still there.

Answer 9

Files are not really erased when you use the "delete" button. Trained computer professionals are able to retrieve them from where they are on the computer's hard drive.

Answer 10

b/c even though you erased it there is still a "shadow" on your hard drive of what it was, you can still pull up deleted items if you know the codes