How FBI is able to recover evidence from computer hard drives, even after a user has erased/deleted the files?

Answer 1

The files arent actually deleted when you delete them. The computer just tells the system that these files can be overwritten. It doesnt mean they are!

Answer 2

Ok, im going to go abstractly on this, I hope you can follow me =)

Think of your Hard drive as a Piece of paper with a thin layer of sand on it. Those pieces of Sand represent the 1s (the empty spaces represent the 0's) on your hard drive.
Now, imagine another piece of paper, with text writen on it like this..

somefile.txt -> 3.2 x 2.9

This is the index in which your computer finds files. So if you wanted to see somefile.txt, your computer would look at index, and see 3.2 x 2.9, so it will goto your harddrive and look at the page 3.2 inches over, and 2.9 inches down and in that location will be the data which makes up somefile.txt.

I hope that made sense.. Now, if you delete a file, your computer doesn't actually remove the pieces of sand, instead it will remove the entry in the index, so the file still exists, it just can't be read from the index.

Since the file still exists, there are ways to scan the entire drive looking for deleted files which don't use the index paper.

If you wanted to be paranoid and make sure theres almost no chance of reading deleted files, you'll want to invest in a drive cleaning program. (I dont have any recommendations, search yahoo for 'CIA drive cleaner')

There are two ways to clean a drive, the standard wipe, and the CIA wipe
The Standard wipe just removes all those bits of sand from the paper. But, the way magnetic media works, its still possible to recover the data..
a 'CIA' wipe, instead of removing the sand, adds sand to it covering the entire surface with 1s. This works better as there arent as many residual images of files left.

Answer 3

When you delete a file you are really just deleting a pointer to it. The information still exists on the hard drive until overwritten several times. Here is a link to a utility that will erase a hard drive completely http://dban.sourceforge.net/ Remember that this utility destroys all data so make sure you have important data backed up and the re-install disks before using it. :)

Answer 4

when you erase a file from your computer...have you ever noticed how it takes virtually no time to delete a massive file...but it takes several minutes to write a large file to a disk. When you delete files all it is actually doing it erasing the pointers to where the data resides on the disk...it doesn't actually disappear. When the pointers are erased it tells the operating system that "ok you can now write to this space".So It just sits on the disk waiting for something to be written over it.

Answer 5

If you are selling your computer, thoroughly clean your hard drive. Deleting files and reformatting is not enough. Reformatting does not overwrite every sector, and private information can remain retrievable. Use a secure delete or disk wiping utility to overwrite every sector on all hard drives. Be sure to use a utility that supports the U.S. DoD standard of seven passes or wipes. While this method is good enough for most people, be aware that the only absolute way of destroying all traces of everything your hard drives is to have these disks degaussed (demagnetized) and physically destroyed.
Suggested: BCWipe, Evidence Eliminator, or SDelete.

Answer 6

It is quite simple. When you delete a file the computer doesn't actually delete the file it just marks the file as deleted so that the space can be used later by another file however until another file actually overwrites the space then the info can be easily recovered.

Answer 7

THey can look deep in your cache file of your cpu or any cpu esepcially if the computer has a cable network to communicate with your computer. All deleted files are stored in this folder even after you have completely deleted them from your Recycle Bin. THey have lots of ways of doing it this is not one of them.

Answer 8

Theoretically, there fairly isn't a thanks to thoroughly delete a report from a demanding rigidity. Degaussing (use of a huge magnet) does the most yet even it truly is not any longer finished. commonly speaking, a pc lays archives down on tracks. once you delete a report more desirable like than no longer that report exist blended up with different archives. each of the computer does is say that this disk is able for getting used. although, it does no longer unavoidably use that area and rather a lot under no circumstances makes use of each music that became deleted for a report (noticeably large archives). There are software courses which will study the exterior of a disk and recreate all of those and zeros it unearths.

Answer 9

because acc to reserch data on a hard disc never gets deleted it just gets disappered whn u del it n other data is written over it... bt acc to reserch data can be recovered even after formatting ur hard disc for 35 times...