Electronic Fingerprints

Electronic fingerprints remain available for review if you know what to look for. The skeletal remains of files deleted or history of persons and places visited are seemingly hidden in the world behind the computer’s display. A plan to recover this information by a team with computer forensic expertise can be a powerful tool for civil and criminal litigants, for law enforcement, and for computer support services.

File deletion either through an accident, an application, or through the familiar desktop icon, the trashcan, seldom makes recovery of the deleted files impossible. Use of these commands on most computers merely delays the inevitable recovery of the files by those with a desire to do so. Most computers delete files by eliminating entries on the directory or index of the hard drive, but really the data associated with those entries remains accessible. Experts frequently analogize such deletions to the tearing of the table of contents from a book. Even though the outline of the book has been removed, pages of content remain.

Many common consumer applications can resolve these deleted files. Recovery of the files for evidentiary purposes requires the use of a computer forensics expert. These professionals use techniques designed to maintain chains of custody and software designed to assure an audit trail for files recovered. Professional recovery using scientifically valid recovery methods prevents claims that files recovered are not admissible for a number of evidentiary foundational reasons.

The computer forensics expert can also help devise a strategy to efficiently recover relevant data from diverse types of storage devices and from a number of geographically distinct storage locations. A well-planned search strategy can maximize an investment made in a forensic investigation. One megabyte of data is roughly 180,000 words of text or about the size of a typical novel. One gigabyte of data is 1,000 megabytes and will contain the information that one might find in 1,000 books.

With the price per megabyte of storage plummeting, large capacity storage devices capable of storing 120 gigabytes are common and cost less than $200.00. A poorly planned or executed search strategy can be quite costly. Searching the wrong storage device or looking in the wrong places will mobilize a marathon of futility; like searching 120,000 books in the wrong library.