Wrapping it Up
I know this example of data recovery is very basic. Would it were that all data recovery jobs were this simple! But the principles and procedures detailed here are the same whether we’re dealing with an 8 GB thumb drive (FAT 32) partition or a 4 TB hard drive with multiple partitions. Hardware and software are the variables. The constants are the procedures and methods used to acquire, analyze, carve, locate and report the lost data. Ultimately, these methods need to be repeatable and defensible in a court of law because that’s what “Forensics” means.
Not every job is this straight-forward or simple, but with a little problem-solving, tenacity and experience, a competent examiner can put these methods to work to help recover just about any lost data!
Author:Patrick J. Siewert
Principal Consultant
Professional Digital Forensic Consulting, LLC
Virginia DCJS #11-14869
Based in Richmond, Virginia
Available Wherever You Need Us!
We Find the Truth for a Living!Computer Forensics — Mobile Forensics — Specialized Investigation
About the Author:
Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia. In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation investigations in Virginia court history. Patrick is a graduate of SCERS, BCERT, the Reid School of Interview & Interrogation and multiple online investigation schools (among others). He is a Cellebrite Certified Operator and Physical Analyst. He continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations, while keeping in touch with the public safety community as a Law Enforcement Instructor.