What do you need to know to be a forensic computer person? If a hard drive is formatted and a forensic?

Question

guy or gal tries to reconstruct what was on the hard drive what are the tools and methods used to do this? Is there something stronger than recovery applications? Like maybe knowing how to use assembly language?

Answer 1

recovery application still relies on the hard drive head reader itself.

There are two ways of formatting. One is you delete the adress of the data, which means the data will appears invisible to your system, but it's still there, until new data is written over it. Most application works on this, where it search data without refering to the address table. It's usually called quick format.

A full reformatting writes 0 (or 1, doesn't matter) over all previous data, this way, your hard disk cannot recover it, applications cannot recover it.

But there are still magnetic traces left behind by previous data, and this is where forensic looks at, of course you have to take out the plates from the hard disk and use special equipment to process the plates. You cannot do this at home.

You cannot rely on software or programming because software still reads the data straight from the hard disk, and that means you relies on the hard disk which cannot read data from left over traces of previous data whatsoever. Special equipment is used to recover such data.

AFAIK, it was shown that they could recover data that has been written over and over up to 6 times.

Answer 2

yes. what you said. its also looking at the hard drive sector by sector and reconstructing what is there. For example, a quick format just tells the computer that the space is available to write to but doesn't change the data there. same with deleting a file. you know of course that files can be recovered when accidentally deleted.
What you have to do is look at each sector of the hard drive and reconstruct the contents. was it a program? text?
also you know a file is scattered all over the hard drive, so you have to find what parts go to what files.
its tedious, boring and dull work.

Answer 3

Formatting a hard drive doesn't always clean it up.

It's like taking a book and deleting the index - you can still read the book - but you can't find specific items quickly.

Now, imagine the pages in the book are scattered all over the place.

What the expert does is recreate the complete data from this mismatch.

One advantage is that small documents like pictures usually fit on one page - so there's not the need to try and piece pages together to see if someone has been downloading inappropriate images

Answer 4

If the hard drive has simply corrupted, lost, deleted files, they use software to attempt recovery...

Some softwares are better than others yes, they scan multiple times to ensure accuracy of data being recovered...

If the hard drive was physically damaged, like it got old and broke, or someone dropped it, usually recovery is quiete expensive. To recover data in that case, they usually take parts from same model hard drives or similar parts, and attempt to repair the physical aspects of the damage by applying replacement peices. Then they take files off.

Other than that, there is no super huge top secret recover program. There are programs that only the cia and fbi can use. But data is data, sometimes the best of the best cant recover it.

Answer 5

The only thing that most people will know about the methods of reconstruction will come from various CSI episodes.

It think it would be a fascinating job.

Answer 6

Science and I.t and some times certain computer languages but that is less common now