Computer Forensics & Data Recovery

X-ways Forensics is a piece of forensic software that has been around for awhile now. I took a look at it about a year ago, while impressed, I wasn’t quite ready to shell out the almost 1000 US Dollars to purchase it. Recently, I requested another trial of the software. I did some testing and experimentation with the software.

I was very impressed with its user interface and its abilities. One thing that it does that is very nice is sorting pictures by skin tone percentage. If you work a lot of cases where that is a big factor, like I do, that is a GREAT time saving tool. It will save me a lot of time browsing assorted photos and cached website graphics.

The interface is usable and as intuitive as forensic software gets. This software is not really for the casual computer user. I would recommend it more for people on the tech level of forensic examiners and network administrators.

The ability to interpret NTFS and locate deleted files was excellent.

BEST OF ALL, it did not freeze or crash once while I was testing it. This is very unlike some high priced forensic software I have at work….. Examiners have a motto for this other software, “Save early and save often!” X-Ways seems to be far more stable and it cost less than half as much.

After I purchase it, I will try to get back with a more detailed review.

Spyware is a fact of life on the internet.  I have tried several pieces of software.  Not what I would call an in depth detailed analysis or anything, but, enough to form my own opinion.

There are two pieces of software that I have found to be usefull.  One is Spybot Search & Destroy and the other is AVG Anti-Spyware.

Spybot has a database that is updated regularly.  It is effective at spyware removal.  It also “immunizes” your computer against many known threats.  It has many other tools built in for the advanced user.  I don’t recommend using the “tea timer” that  blocks registry changes.  The “tea timer” becomes annoying and cumberson over time. (I am still looking for a registy sentry I really like, stay tuned.)

AVG is probably a better product now.  The reason I say that is, even though it is free, it has a shield function (like your anti-virus) to stop spyware from getting on your computer to start with.  My spyware infections have went way down using the shield.

Pop a top, and have a drink to safer surfing!  I am about to

I love it when you see computer desks advertised for sell, they never show the cables.  We all know why, because that nasty nest of tangled wires is terrible looking.  Most houses have a computer desk that has that mass of wires.  I hate that disorganization.  (Doing computer forensics, computer repair, and investigation; I am as bad as anyone with ending up with wires and gizmos everywhere.)

Well, there is a site that has a very nice solution.  It is so elegant, it is almost like making your desk an extension of your computer case. Basically, peg board is used to mount everything vertically behind or horizontally under the desk top.

There are lots of pictures at  http://www.decluttered.com

I am periodically asked by friends and family, “Should I repair my old computer, that just broke, or but a new one?”

That is obviously a question with alot of different variables.  My first question would be how old is your computer, how much is it worth, and do you have the money/need/desire to buy a new one? 

The key is to compare the cost of the repair, with how much the computer is worth. If the cost of the repair approaches the value of the computer or the cost to buy a new one, I would not have it repaired. If all you afford is to have it repaired, I would try to locate a friend who is good with computers or repair shop who will quote you a flat rate for labor plus parts.

If you decide not to repair the computer, consider donating it to a charity that repairs computers.  These charities generally are aimed at bridging the “digital divide” by giving these repaired computer to low income families.  The charity generally serves the dual purpose of training kids in computer repair.

 If you have the money to repair the computer, but still really want a new computer; I would consider fixing the old computer.  I would then use it as a kids computer, storage server, or “always on” internet appliance for checking you email without having to boot up your new computer.

Of course the storage server suggestion, is another article in itself.  If you search the internet, you can find “how to” articles on the subject.

One last comment, and sorta a pet peeve of mine, just because “Windows” is broken; it does not mean the computer is broken.  The hardware could be just fine.  Often when people think their computer is “broken,” all they really need is a fresh install of “Windows.”  (Course I think you should at least look at Linux….but that is a whole different article also)

Also, don’t fix the computer, just to get the data.  The hard drive can be removed and the data recovered for $100 to $200 dollars, just as long as the hard drive is not what is broken.

Hope this helps.  (If you live in Gainesville, FL and have that broken computer http://www.datatriangle.com/services .  That is my shameless plug. )

My hard drive crashed! I lost my data, Word documents, and pictures. Can you get my data back?

This is something of how my calls for help usually go. The short answer is “yes,” most probably. It depends on who you talk to in the data recovery and computer forensics business, but the recovery rate is probably over 90%. Now this is including software and hardware recovery techniques.

Now what I am calling hardware recovery, is that the drive itself has stopped functioning reliably or at all. This can be a mechanical failure, such as the motor that makes the disk spin has stopped working. A key symptom of a mechanical failure is the drive making strange noises. Loud clicking, up and down loud humming, or a grinding sound. If your drive is making a grinding sound….that is REAL bad. If you want ANY chance of getting your data back, pull the power and seek professional help!

As a consumer, you are usually not real interested in my detailed description of what I believe the cause of the problem or failure is….. As my wife will say when she has a computer problem, “Just make it WORKKKK!” Oh yeah….banging on your keyboard and hitting the computer generally doesn’t solve your problem either.

Of course the other thing the consumer wants to know is, how much will it cost? This is a reasonable question. As a person or a business you have to make a decision of whether or not your data is worth that much money to get back. Data Recovery is a new enough field that I can’t give you a great answer on how much you should pay. I will give you some guidelines and thoughts.

If you are the average consumer, no RAID drive configuration and you data is not in some super encryption format, it should be a pretty standard cost. Whoever is doing the work should be able to give you a rate on how much they will charge. For a software only recovery, you should pay between $150 and $400 dollars. If it is a mechanical failure it is a lot more specialized repair, requiring more equipment. A ball park price should be $500 to $1400 dollars. I realize that last one is a real wide range, but so are the prices companies charge for those kinds of repairs.

I hope you are never in the position to have to read this article for more that personal knowledge enrichment!

I am based in Gainesville, Florida and can be reached by phone or email for individual advice. http:www.datatriangle.com/services