Anyone know a computer forensics person to asks if someone wipes important info. off the internet
history how it can be retrieved... Thanks for any suggestions of help in this matter....
TroglodyteScholar
(5,477 posts)midnight
(26,624 posts)every twenty days and no longer exists.... However years ago, it was discussed that once a search is made that history lasts.... I'm wondering if search histories are not really lost or removed but retrieved via another method not made available for some other reasons?
TroglodyteScholar
(5,477 posts)You might want to see if the index.dat file was left intact. Read here:
https://en.wikipedia.org/wiki/Index.dat
This tool may be helpful if you don't mind going into world of the command prompt...
http://www.tzworks.net/prototype_page.php?proto_id=6
midnight
(26,624 posts)RoccoR5955
(12,471 posts)The only way would be a bit by bit scan of the computer.
You should remember that files are not really deleted on a computer, until the storage (aka hard drive) is out of room. They are then overwritten.
Typically, when you delete a file, the file is marked as deleted, and eligible to be overwritten, if needed, on that part of the storage.
There is software that can read the raw data on a storage device, and this is what is necessary if one is to read a file that is "deleted."
midnight
(26,624 posts)computer a company is claiming was removed via their twenty day policy? Thanks...
RoccoR5955
(12,471 posts)There is a piece of software called "Disk Investigator," which will allow you to do a sector by sector read of the hard drive.
It is a very painstaking task to find data, if you don't know EXACTLY what you are looking for. You can page through the millions, even billions of bytes on the HDD to see the data, but it will take a LONG time.
http://www.theabsolute.net/sware/dskinv.html
There's a link in case you are curious.
I do not know the method that such a software company can use, but they may replace the data with zeros and ones, if they truly seek to remove all traces of the data.
midnight
(26,624 posts)info..
RoccoR5955
(12,471 posts)What would help, would be the specific areas of the disk, or using the search function, if one is built in, some word that is unique to the files, but I am guessing.