(1) In this lesson, you learn the essentials of file recovery in the three major operating systems. Discuss how to recover information from damaged media. Also, tell us your experience how to recover files from a crashed hard disk or a bad memory card.

In this days, deleting a file is a common thing either from phone, computers or any other digital storage device. If someone doesn’t want any data or they don’t want anyone to see it, then they just go ahead and delete it. Criminal does the same thing if they are not very technical or smart enough then they think deleting a file will keep authorities from discovering it. For this reason, retrieving a deleted data is one of the fundamental tasks that forensic examiner must conduct during a crime investigation.

          Restoring data is only easy when the deleted data is in the recycle bin. Recovery may be required due to physical damage to the storage devices or logical damage to the file system that prevents it from being mounted by the host operating system (OS). When media is damaged then the drive is removed and connected to the test system. After this, the test system is booted and files are copied from drive to test system. But sometimes if the drive is damaged badly then the test system won’t recognize the drive. In this case, the drive must be repaired. This is how physical damage is restored but logical damage is caused by power outages or turning off a machine while booting a system or mounting the file system. TestDist, The Sleuth Kit, Disk Utility (Mac OS), fsck(Linux) and chkdsk(Windows) are the different tools for the different operating systems to recover data from logical damage. After all this process we can never tell that data can be fully restored or restored at all.  

          CDM command line is the first way to repair damaged memory card without formatting, another way is to check and fix the memory card. Also, there is third party software like EaseUS that can be helpful to recover data from the damaged or corrupted memory card.

Reference: -

https://ecodatarecovery.com/forensic-data-recovery-investigation-steps/