Deleted_Files_Forensics_Paper_.docx

Deleted Files Forensics

Victoria Robbins

Liberty University

It is fairly common to delete files whether by accident or the computer system mistook an

order or deleted files when updating its systems. Because of how frequent files being deleted

occurs there are different types hardware and software systems that were built to help with

retrieving the deleted data. It is harder to retrieve files that were deleted when there are no or not

a narrow number of parameters of which files need to be retrieved can be searched for by it can

slow the process down and take time to find the files but when you have parameters or know

Since the Liberty corporation develops financial software the Digital Forensics Unit and

Lab would be prepared with different hardware, systems and programs to help protect the

financial software and to retrieve files that were deleted. The employee would need to be asked

questions such as whether she used a computer or a laptop, what model the computer or a laptop

is (Dell, HP, Mac, Notebook and etc.), what operating system the model has, what type of core

system or the hard drive is , what programs and systems are already on the model and etc. the

reason those questions or similar ones must be asked is so the right equipment can be used to

successfully retrieve the deleted files while not causing damage to the computer or laptops hard

drive, other systems and files.

Out of all the different models and operating systems for computers and laptops the two

system built into their devices and Apple’s Mac brand of devices. There are different systems,

tools and codes that can be used that were built into windows system and outside programs used

by forensic teams bring back deleted files. If the employee was using a Windows system, there

are two programs that could retrieve the files data. Those two programs are created and

distributed by Stellar data recovery and are called DIY Windows Data Recovery Software for

Quick & Easy Recovery and Professional Data Recovery Software for Windows that are

Professional Data Recovery Software for Windows allows for effortless recovery

software for any lost data situation, data from any Window devices and compatible external

storage media systems, data from corrupt hard drives, lost partitions, optical media, can recover

any file types by using the files signature, and a add-on drive monitor utility and disk cloning

systems to secure the data recovery. This program can recover data from missing partitions that

are lost by either a corrupted drive or file and files that were accidentally deleted through a quick

photos, videos, audio files and more media types recovery options with better capabilities than

the DIY Windows Data Recovery Software for Quick & Easy Recovery program can. The four

key features for this program are “Optical Media Recovery, Recovers Lost or deleted Email

Files, SMART Drive Monitoring and Cloning, Disk Imaging for Speedy Recovery”

(Professional Data Recovery Software for Windows).

According to Nelson, Phillips & Steuart after files have been deleted through Windows

or File Explorer it can be retrieved through the Recycle Bin but the Operating System does the

following:

Windows changes the filename and moves the file to

a subdirectory with a unique identity in the Recycle Bin.

Windows stores information about the original path and

filename in the Info2 file, which is the control file for the Recycle

Bin. It contains ASCII data, Unicode data, and the date and time of

the lab and was unable to find the files under the original names.

There are some built in protection systems from Windows that could be used to try and

recover those files without using outside programs to retrieve these files by. One built in

protection provided in Windows 7 is the default shadow volume protection it includes the

Windows Database Search folder and these two programs provide shadow copies of data that

may be missing some data or produce better results than using System Volume Information. One

more program or option to try and retrieve data through is Windows.edb. According to Chivers

& Hargreaves:

• Recovery of the database file, Windows.edb, may

also allow the recovery of file content; and

• Since the shadow volume is an incremental backup, it

may fragment some records, and hence not all the records available

from shadow copies may be carved directly from \System Volume

Information\.

The required files (Windows.edb, ∗.log and MSS.chk)

can be obtained by forensic recovery tools, or by building a clone

There are different programs, hardware, systems that may or may not be already built

into a computer or laptops operating system and there are external options designed for specific

operating systems to avoid disturbing or damaging the system while scanning for and retrieving

the lost or deleted files. It is important to ask the employee questions about their system and the

data they lost or accidentally deleted to establish parameters to search and retrieve the data by.

Another reason it is important to ask the employee questions is in order to purchase or use the

right type of equipment and programs that will not damage the computer or laptop operating

systems, any data or files and any lost or deleted data or files information.

References

Chivers, H., & Hargreaves, C. (2011, April). Forensic data recovery from the Windows Search

Database. Retrieved from https://www-sciencedirect-

com.ezproxy.liberty.edu/science/article/pii/S1742287611000028

Recovery, S. D. (n.d.). DIY Windows Data Recovery Software for Quick & Easy Recovery.

Retrieved from https://www.stellarinfo.com/windows-data-recovery.php

Recovery, S. D. (n.d.). Professional Data Recovery Software for Windows. Retrieved

from https://www.stellarinfo.com/windows-data-recovery-professional.php