Data Recovery Digest

If you’re a fan of crime dramas like CSI, NCIS, The Mentalist, Law & Order, and all of their spin off shows, you have probably watched an episode during which the perpetrator has hidden important information on some sort of data storage device; information that can save someone’s life or prevent a major catastrophe. They may have tried burning it, tossing it in a river, caressing it with a high powered magnet, or “scrubbing it” to remove all data, but there is that one cop or FBI agent that has the ability to recover the missing or destroyed data using state-of-the-art data recovery methods.
Does art imitate life or are the methods used on TV only meant as a way to move the plot along?
The TV Scenario
Picture this: a lone man sits in a chair. Before him is a pretty elaborate computer set up, and above him are four very large flat screen monitors. This man has been given a hard drive that was found in the burned out wreckage of the victim’s home. This man’s job is to recover data from this hard drive that may help them find the killer.
So, what does this lone man do to recover the data? He plugs the hard drive into a USB enclosure, hits a sequence of keys on the keyboard, mutters to himself, and screws his eyes up at the four large monitors trying to uncover the information this hard drive holds. Suddenly his eyes grow large, he calls in his supervisor and shares with him that one single piece of information that is crucial to the case – information he pulled from the dead hard drive.
Is this realistic? Is this how data recovery really works?
No.
Real data recovery requires the right recovery software, knowledge of where the data has been stored on the hard drive, and a lot of patience. If the data is stored on an intact hard drive that has been scrubbed, if you don’t know where to look for the missing data, you can spend hours or days sifting through files to find it. Because, in reality, finding scrubbed data can be a long, drawn out process, the TV shows will move the plot along quickly by shortening this part of the process; making it fit into a 45 second montage of clicking, keying, and muttering.
If the data is stored on a hard drive that has failed, been through a fire or flood, or dropped from a building, the tech will need to transfer the information (however much he can find) to another storage device and then sift through the scattered pieces of files from there.
Forensic Data Recovery
Forensic data recovery is the systematic and detailed process of retrieving information from electronic devices such as cellphones, computers, car computers, GPS systems, etc. The information gathered is then used in civil cases, such as creative accounting or divorce proceedings, and criminal cases. The information retrieved can be anything from the defendant’s location on a certain date/time, or files and images that contain damaging evidence.
The actual process of forensic data recovery involves the use of exclusive data recovery software and a variety of methods to retrieve, reconstruct, and fill in the missing pieces of data. A forensic data recovery technician can take a hard drive found at the scene of the crime, retrieve the data with their software, analyze that data, and uncover traces of information that can turn the tide of the case. A common technique for forensic data recovery is used to recover and restore a deleted or damaged partition. They will use their software, and no shortage of tricks and skill to piece together important data on that specific partition.
In some cases, the technicians are working with a device with built-in or specially created security measures. When retrieving the data, the technicians must be careful not to trigger these measures which could make data recovery more difficult.
Don’t Be Fooled
When it comes right down to it, though it goes through a lot of trouble to make things as “real life” as possible, TV shows will never be accurately realistic. TV is meant to entertain us – that’s it. Data recovery on TV is part of the plot that is often the victim of creative license. When your hard drive fails, don’t let what you see on TV fool you into thinking it’s as easy as switching on a special device. It takes work, know-how, and time.