Digital Forensics

How Digital Forensics Accesses Data Which Has Apparently Been Deleted

Digital forensics is one of the most recent developments in the long developing science of forensics. The ability to examine evidence and draw conclusions has changed forever the way the legal system operates in the Western world. Whenever forensics is mentioned, people think of the human body and the evidence it leaves behind, usually in the form of fingerprints and other material which is deposited from the body. More recently, people have started to think of the DNA testing which is still controversial. There are, however, many other forms of forensics.

The ability to analyze a computer system and search for data is also a form of forensics, even though it may not initially seem to be a related discipline. This branch of the science is based upon the fact that data which appears to have been deleted from a system may not actually have been erased for good. Most digital systems only erase data finally when it is overwritten by new data which needs the memory room that the old data was using up. This means it can be accessed by those who know how to reach it.

The key to discovering lost data is to understand how files are deleted from a computer system. When you delete a file on a Windows computer, it goes to the Recycle Bin. From there, you can either empty the Bin, or use software which does this as part of a clean up of unwanted files. It will appear as though the file is lost and gone forever. This is simply an illusion, as the actual data will still be in exactly the same place. All that will have happened is that the indicators in the operating system which point to the file will have been changed and then deleted.

The bytes of data which were apparently deleted remain in memory until they are overwritten by new data. This could happen within minutes, as the user creates new files which need the space, or it could never happen. The data which is believed to be deleted could survive for years unknown to the user if no other data overwrites it. A digital forensics expert can quickly access all areas of memory to see if there is anything of significance still left on the hard drive.

This technique for finding deleted data is obviously hit and miss, as there is obviously no control over what is left and what is not. It can, however, turn up some extremely useful evidence. The same system can also be applied to other electronic devices which store information, especially cell phones. When you think of the data which is stored in the typical cell phone, you can imagine how useful it would be to have access to one belonging to a criminal. Even being diligent enough to constantly erase data may not be enough to defeat digital forensics.

 

 

Advanced Search Tool:

 

It may not always be the case but you should assume the links on this website are affiliate links which means that we will be compensated if you choose to buy at some point in the near future. Please accept our thanks for your support.

Articles

• Computer Forensics
• Forensics Investigator
• Forensic Scientist
• Computer Forensic Investigations
• Forensic Training
• Forensic Expert Witness
• Forensics
• Forensic Classes
• Cyber Forensics
• Forensic Nursing
• Forensic Data
• Forensic Examiner
• Forensics Jobs
• Forensics School
• Digital Forensics
• Degree In Forensics
• Forensic Accountants
• Forensic Engineering
• Computer Security Forensics
• Forensic Psychology



• Social Bookmark This Page
• 
• 
• 
• 
• 
• 
• Privacy Policy
• Terms of Use
• Contact Us
• About Us
• Sitemap