Information Technology Reference
In-Depth Information
bytes.that.make.up.the.iles.still.exist,.all.except.for.the.cor-
rupted.ones..Or.they.might.all.still.exist.but.simply.have.that.
“deleted”.lag.prepended.to.them..If.these.have.not.yet.been.
overwritten.or.are.not.too.seriously.corrupted,.it.can.be.rela-
tively.simple.to.recover.them,.given.the.right.tools.and.skills.
The.best.example.I.can.give.to.illustrate.this.is.one.that.
happens.to.me.fairly.often.in.my.role.as.the.community.foren-
sics.dude.
I.will.hear.someone.bemoaning.the.fact.that.he.or.she.just.
uploaded.all.their.pictures.from.their.vacation.to.their.com-
puter,.then.pressed.the.wrong.buttons.and.deleted.all.of.them.
from.both.the.camera.and.their.computer.
Or,.someone.will.tell.me.that.their.computer.was.infected.
with. a. virus. and. he. or. she. can. no. longer. get. it. to. start. up.
and.all.of.their.important.documents.were.never.backed.up—
Forensics.Dude.to.the.rescue.
With.tools.at.my.disposal,.I.can.often.gain.access.to.a.cor-
rupted.hard.drive,.or.ind.all.those.deleted.iles.on.a.camera.
memory.card.or.computer..Those.tools.basically.take.a.look.
at.the.hexadecimal.code.that.makes.up.all.those.iles..Then.it.
goes.through.and.recognizes.the.pieces.of.different.ile.types.
and.puts.them.back.together.again.in.a.form.that.I.can.then.
export.to.recover.the.data.
In. computer. forensics. terms. this. is. called.
data. carving
.
because. the. tools. look. through. the. lines. of. data. stored. on.
whatever. medium. we. are. searching. through. and. carve. out.
the.pieces.that.make.up.different.ile.types.
The.way.it.recognizes.those.iles.is.by.standard.ile.head-
ers.or.bytes.of.data.that.tell.the.operating.system.the.type.of.
ile.that.is.stored,.its.length,.date.and.time.information,.and.
possibly.information.about.where.on.the.disk.different.parts.
of.the.ile.are.stored.
All.of.this.information.is.part.of.something.we.discussed.
in.other.chapters.called.
metadata
.or.data.about.the.data..The.
operating. system,. applications,. and. my. forensics. tools. read.
that.information.and.use.it.to.access.the.data.that.make.up.all.
the.different.types.of.iles.
