by tink09 on April 18th, 2009

tink09

Question

Help answer this question below.

How is the FBI able to recover evidence from computer hard drives after a user has erased or deleted files?

  • Like
  • Report

Answers. 9 helpful answers below.

  • by Beavis - the other white meat on April 18th, 2009

    Beavis - the other white meat

    There is very little that a good forensic computer tech can't recover, & the FBI has access to some of the best. Then again, you have to do something interesting to draw that much attention.

    • Like
    • Report

    No comments. Post one | Permalink

  • by Henderson on April 18th, 2009

    Henderson

    actually, erasing of file means just remove the reference to the given file. It's similar to delete the record where that file exists. However still the data is on the disc until some other file is written on it. So not only FBI anyone can recover deleted file using simple recovery tools.

    • Like
    • Report

    No comments. Post one | Permalink

  • by Keysha on April 18th, 2009

    Keysha

    Erasing or deleting files actually just erases the address. Until that information is written over, it is still there, to be retrieved by anyone. The only almost positive way to delete it, would be to record so much it filled your hard drive, delete it all, then write something else over it. Delete that, then reformat. The first information is gone. Usually.

    • Like
    • Report

    No comments. Post one | Permalink

  • by Occams Electric Razor on April 18th, 2009

    Occams Electric Razor

    because most times when data is erased from a drive it is not totally erased. There are now programs to erase things completely but unless you use those or totally reformat the entire hard drive there are still traces of the deleted info on the drive and it can be retrieved.

    • Like
    • Report

    No comments. Post one | Permalink

  • by yahoot on September 28th, 2009

    yahoot

    They hook up the hard drive to a computer with software that can read back the information on the hard drive bit by bit.

    As others have said, when you "delete" data on most computers, it doesn't actually wipe the information out. It just marks the area the data is in as being "available for writing data". Until something new gets written in that area, the old data is still there. So, they just go in and read all the data that is still there, including the areas where data was "deleted".

    there is a detailed explanation at http://en.wikipedia.org/wiki/Data_recovery

    No comments. Post one | Permalink

  • by laobali on June 13th, 2009

    laobali

    There are commercial companies that anyone can use to try and recover data from a drive which has 'failed' or lost its format or indexes, including intentionally (so-called) deleted files, even a re-formatted drive, unless new data has overwritten the old at a particular location.

    There are varying degrees of difficulty doing this, some relatively cheap and others more time-consuming and therefore expensive.

    No comments. Post one | Permalink

  • by Anonymous on September 28th, 2009

    Anonymous

    HOw is the FBI able to recover evidence from computer hard drive this is for a school home work for a collage student

    No comments. Post one | Permalink

  • by Anonymous on September 28th, 2009

    Anonymous

    how is the evidence recovered that is the couestion that i on my paper

    No comments. Post one | Permalink

  • by aaron on April 18th, 2009

    aaron

    Because when a file is deleted, all that does is delete the entry in the FAT table. The FAT is just an index pointing to the information, like in a book. It does not delete the file. So why does the space come back? Because the index is missing and the operating system assumes the space is available. The only way to completely delete data is to low level format, or if you delete a file and put something else in that same place. All a high level (regular) format does is delete the entire FAT index at once. The actual data is still there. This is now recovery utilities get the data back, it was never gone. So anyway, that is what often happens and why data can be found. A regular delete only removes the pointer to the file from the FAT table, the actual data is not touched.

    No comments. Post one | Permalink

Want to attach an image to your answer? Click here.

Did this answer your question? If not, then ask a new question or create a poll.

More Questions. Additional questions in this category.

You're reading How is the FBI able to recover evidence from computer hard drives after a user has erased or deleted files?

Follow us on Facebook!

Related Ads

ANSWERBAG BUZZ

How does the fbi recover deleted files
If you reformat your computer can the fbi locate deleted files
How does the fbi recover files that have been deleted off a computer and recover them again
How fbi recovers deleted files
Fbi can recover overwritten data