- NEW!
Help answer this question below.
There is very little that a good forensic computer tech can't recover, & the FBI has access to some of the best. Then again, you have to do something interesting to draw that much attention.
actually, erasing of file means just remove the reference to the given file. It's similar to delete the record where that file exists. However still the data is on the disc until some other file is written on it. So not only FBI anyone can recover deleted file using simple recovery tools.
Erasing or deleting files actually just erases the address. Until that information is written over, it is still there, to be retrieved by anyone. The only almost positive way to delete it, would be to record so much it filled your hard drive, delete it all, then write something else over it. Delete that, then reformat. The first information is gone. Usually.
because most times when data is erased from a drive it is not totally erased. There are now programs to erase things completely but unless you use those or totally reformat the entire hard drive there are still traces of the deleted info on the drive and it can be retrieved.
They hook up the hard drive to a computer with software that can read back the information on the hard drive bit by bit.
As others have said, when you "delete" data on most computers, it doesn't actually wipe the information out. It just marks the area the data is in as being "available for writing data". Until something new gets written in that area, the old data is still there. So, they just go in and read all the data that is still there, including the areas where data was "deleted".
there is a detailed explanation at http://en.wikipedia.org/wiki/Data_recovery
There are commercial companies that anyone can use to try and recover data from a drive which has 'failed' or lost its format or indexes, including intentionally (so-called) deleted files, even a re-formatted drive, unless new data has overwritten the old at a particular location.
There are varying degrees of difficulty doing this, some relatively cheap and others more time-consuming and therefore expensive.
HOw is the FBI able to recover evidence from computer hard drive this is for a school home work for a collage student
how is the evidence recovered that is the couestion that i on my paper
Because when a file is deleted, all that does is delete the entry in the FAT table. The FAT is just an index pointing to the information, like in a book. It does not delete the file. So why does the space come back? Because the index is missing and the operating system assumes the space is available. The only way to completely delete data is to low level format, or if you delete a file and put something else in that same place. All a high level (regular) format does is delete the entire FAT index at once. The actual data is still there. This is now recovery utilities get the data back, it was never gone. So anyway, that is what often happens and why data can be found. A regular delete only removes the pointer to the file from the FAT table, the actual data is not touched.
What are the Bahamas'major landforms?
by Answerbag Staff on April 8th, 2011
| 1 person likes this
What is the purpose of breathing exercises?
by KKFlovesRMW on January 7th, 2012
| 1 person likes this
Is miso soup vegan?
by Answerbag Staff on April 7th, 2011
| 1 person likes this
Which language is easier: Latin or Spanish?
by Answerbag Staff on March 25th, 2011
| 1 person likes this
Which one of the following symptoms indicates that a person is in the alarm stage of stress?
by KKFlovesRMW on January 7th, 2012
| 1 person likes this
You're reading How is the FBI able to recover evidence from computer hard drives after a user has erased or deleted files?
Comments