Most people think that when a certain file or files are deleted it is permanently removed from your computer. Files still remains on your disk and still recoverable even if it’s deleted, formatted or damaged so when there are files needed let’s say as a part of a investigation a computer forensic analyst got the knowledge and the necessary tools to find them.
The average computer user believes that by just pressing “Delete” the files are gone for good they don’t see the potential evidence that are still kept on their disk. All files that are deleted are still very much possible to recover provided that it is not overwritten. Files that are deleted are just relocated in what we call the “non-live” areas of a disk. These are also called unallocated clusters that can hold gigabytes of deleted data.
Computer Analysis are done by highly qualified and skilled practitioners. These people fully understands the science of recovering valuable informations, which can be used as a vital part within a court case.
Depending on the files or data that are still on the disk, these forensic experts can still find lots of valuable information about it’s background. For instance, they can even tell the username or login name when the files are deleted including it’s date and time when the removal occurred. Some people sometimes tries to disguise criminal data under a different filenames and extensions but those tricks is not effective to Forensic analysts. They have the tools and proper procedure to see those harmful files even if its hidden or cloaked as something else.
Do you know that even passwords are not enough to keep forensic experts out of your files? forensics have tools to break even the hardest and encrypted passwords. No matter how secure your password is forensics can still find ways to break into that file and acquire any important data.
Files that have been corrupted are still possible to be retrieved. Even if the forensics can’t retrieved the whole data a partial recover is enough to be used as a vital evidence against a suspect.
The science of computer analysis takes time, patience and dedication. Forensic experts has all the knowledge and tools to check and to know anything has been inputted onto the computer and they can see everything on a hard drive regardless of whether the all files disk has been deleted or corrupted.