Investigation Software

Written by Nicholas Kamuda
Bookmark and Share

Investigation software can be broadly defined as software that allows the user to perform examinations of the content or history of a computer. There are many such programs currently available on the market. Most focus on recent events in the computer's history, such as URLs visited or file downloads or erasures.

Many investigation software programs can perform their functions from undetectable sources. Two common examples are from a floppy drive, and from another computer on the same network. Even when run from a floppy drive, many detective or investigation software programs do not require program installation of any kind.

Common functions in investigatory programs include the ability to quickly scan hard drive content for specified keywords, or for files that may have been pirated somehow. In many cases, the program allows the user to immediately preview the content of any file or folder in thumbnail format. Some programs will do all of this without changing the access dates of the files at all.

File Recovery Investigation Software

Other programs are built for data recovery or cloning. They can perform such functions as quickly copying portions of a hard drive (as an image file), system recovery, or diagnostic tests. Some recovery programs analyze and handle data wholly in binary and hex terms, allowing them to quickly process up to four terabytes of material.


Bookmark and Share