Computer Forensics & Data Recovery

I just wanted to give a little update on my local Gainesville business.  I have been super busy lately! It seems like with every computer repair or data recovery job I do for a University of Florida student or professor I get 3 more jobs.  I am not complaining mind you :)  It just show how valuable word of mouth is among the UF community.

I have been doing more referral work, also.  Other computer shops recommending me, usually after they have given it a shot :)  It is all good.

I just want to thank everyone  who has been recommending me and helping my business take off.  THANKS!!

I first downloaded CNW Recovery this software when I was working on my forensics certification. It was in Beta at the time. It was already then a nice piece of software, but needed some polishing at the time. Even then though there documentation was VERY impressive.

I recently downloaded the demo to take another look at it. I was very impressed. The software is geared towards data recovery, not forensics. The software is extremely versatile. It does a lot more than the traditional, “I can get your photos back” programs. It does have uses for forensics uses also.

I actually had a case where the suspect had deleted the boot sector in an effort to make the drive unreadable. I was able to use CNW recovery to get evidence off the drive. The software was stable and easy to use. It made quick work of the recovery job.

I will be buying the software for my data recovery business.

By the way, I am serious about their manual (and website). You can learn some lessons on data recovery just reviewing all that they have available for reading.

I am predicting that CNW Recovery will be a major player in the future of the data recovery world! Remember where you heard it!

When I have more experience with the software under my belt, I will report back with a more detailed review.

Earlier this week my X-Ways Forensics dongle arrived. (For anyone who is not familiar with that, it is basically a small USB key that is your license for the software.) I spent most of the rest of the week working on a criminal case that will probably go Federal. I mostly used X-Ways as my forensic tool.

The tool has performed as promised so far. All the features have either been intuitive to use or concisely explained in the manual. Some computer software manuals make you feel like the author tried to figure out how to make it as difficult to follow as possible. For instance, I have never found the Encase manual to be an easy read.

With X-ways, I had found files and evidence, within an hour, that I had failed to locate with Encase. I am not claiming that Encase is incapable of finding the same files…. I was just know that I didn’t find them with Encase. I have not attended the Encase training due to their high cost. A trained user may know some way to get the software to find the same evidence. Under X-Ways though, with only a few hours under my belt with the software I was able to find the files.

Speed is one thing that just kept amazing me with the software. This investigation was very image intensive. I was able to just fly through sorting, filtering, marking for report inclusion, viewing, and commenting on files. Even though I was intentionally trying to push the software, I never got a single crash. It was always very quick moving from Hex View, Calender View, Preview…whatever I needed to do. The skin color percentage sort feature for images in AWESOME!

I spent the last few hours of today starting work with the report module. The report module was performing well. I just say well, because I was having to include a lot of images and movies that had been encrypted by the file system of the suspect machine. This required me to recover the files outside of X-Ways then import them into the “case.” The good news is that this is possible and reasonably quick with X-Ways. To start setting up the whole report package for export to external devices was taking some tweaking of the report HTML code. Nothing major, just changing file source addresses. This was because the files were being referenced to their absolute location on the drive and not relative to the report. (In X-Ways defense though, I have to say this was my first time using their report module and I was in a hurry at the end of the day. So, it is possible there is a way to do it that would have saved the HTML coding issue.)

Another important point, I had a question about the software the other day. I sent a support email. I got a response within about 10 minutes from the lead software designer himself. That was impressive service. Can’t say I have ever gotten that good of service on any other software.

I still hope to get back with an even more detailed review when I have more experience under my belt. I wanted to let everyone know how it was going though.

I frequently get approached with the following scenario in Gainesville. I lost some files on my computer, but can’t afford to have professional data recovery done. What can I do?

Well, there are two quick free things that you can do.

1. There is a free piece of software called Recuva by Piriform. They are the same folks that provide ccleaner for free. They of course ask for donations to support them if the software works for you. I have used the software, testing it, with success. It is not by any means a top of the line piece of forensic software, but, for a free easy to use product, it seems to be pretty nice.

2. Many times the problem with recovering files lies with your Windows installation more than with the file. Files can often be viewed and recovered in Linux when they are unreachable under Windows. There are many distributions of Linux that run on a bootable CD-ROM. They are mostly free. I really like Puppy and DSL Linux myself. There are many others though. The Linux approach will involve a learning curve if you don’t know Linux. But, it is free!

A frequent question I get is, “How do I clean up/clean out/ hide my internet history?” There was a time years ago where I might have told a person they better learn A LOT about Windows and computers. Well now there is a lot of software out there that will take care of this for you, mostly.

The one I personally use to clean up the clutter that surfing produces is ccleaner. One of the best things is that this software is completely free!

Running this with default settings will go a long way towards cleaning up your computer. It does a good job of deleting your internet temporary cache files, cookies, URL history, index.dat files, and typed URLs. I have found that it will actually eliminate some problems that are being missed by popular spyware utilities.

If you want a little deeper privacy, the software even has advanced settings that allow for a secure wipe of files that show your browsing history. If you goal is to keep your spouse from discovering what you ordered them for Christmas/ Birthday etc this should be the perfect tool for you.

If you next question in your mind is…does it clean up things well enough that even a computer examiner can’t figure out what I have been doing?? I would suggest that your probably need to just quit visiting the sites that you are.