So your hard disk crashed and you’ve lost all your data – important files, photos of the kids, your contact list and save emails. You are frustrated because you know you should have been performing backups on a regular basis, but you didn’t and now the data is gone for ever. Or is it?
It’s not gone completely and you can get it back. What is the magic bullet? Hard disk forensics.
Hard disk forensics is based on the fact that when a file is deleted from the file system, it actually still resides on the hard disk. It has merely been removed from the file system’s memory. Think in terms of a filing cabinet with labeled folders. Deleting a folder just pulls the label off the folder but it is still there. Only if you actually pull that folder out and shred it are the contents irretrievable. [Read more…]