Data Recovery Software

Written by Nicholas Kamuda
Bookmark and Share

Over the last 10 or 15 years, data recovery software has become highly sophisticated, becoming able to recover most kinds of data that were overwritten, erased, or even physically damaged. In many cases, the software can access the physical data on the hard drive, bypassing the BIOS to proved forensic workers with a direct connection to what they seek. Most modern data recovery software then provides a variety of ways for examiners to find and examine the data, as well.

In many cases, the raw data on a hard drive can be examined and edited using today's recovery software programs. Some programs allow examiners to search for strings of characters all throughout the data, including inside of files, programs, and slack areas. Many programs also include the option of write-protecting the drives, allowing workers to examine the contents without fear or erasing or modifying the original data.

Cloning With Data Recovery Software

Another way that current data recovery software protects the contents of a drive is by exactly replicating a block of data, copying entire sectors or drive partitions to like media. In some cases, the software also allows examiners to compress the data for portability, or make multiple copies, allowing multiple examiners to reconstruct the damaged data as if each was working with the original drive. The cloning technology of some programs will work with most drive formats, including UNIX, Linux, and all DOS and Windows drives.

With some data recovery software programs, investigators can even move each recovered section of data to new media in an extremely organized way by using directory trees. Directory tree organization can also be applied to files that haven't yet been moved to new media, allowing investigators to methodically examine the unspoiled contents of damaged drives. Of course, the option of using the original partitions and file hierarchies is also available.

Bookmark and Share