Recovering Files From Unallocated Space


Recovering data from a hard drive is one of the most common tasks during a computer investigation. Here are a few of the artifacts which computer investigators may retrieve from unallocated (free) space to assist in a case:

* MS Office documents

* Acrobat files (.pdf)

* Email messages and attachments

* Images in various formats

* Internet history (pages visited, searches)

* Registry files (current and past)

* File access records (when and where files were opened)

* Pre-fetch files (when a specific program was ran)

LOADING PDF: If there are any problems, click here to download the file.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pinpoint Labs | Attorney Advertising

Written by:


Pinpoint Labs on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.