On 04/01/2008, at 12:21 PM, Harpalus a Como wrote:
Myth? Why are you so upset about this? It's not myth.
The techniques involved in recovering data in the manner Marco and
the NSA,
DoD, and many others describe isn't a matter of running a simple
software
tool. It's a long, slow, annoying process that is also costly. But
it is
possible. Not every company or person in the forensics industry is a
master
at their job. If they say it's not possible, perhaps it's just "not
something their software package does for them?" (I'm not trying to be
derogatory, but I do know a guy who does computer forensics work,
and the
software/hardware he uses is about all he knows. He just goes
through the
motions. Doesn't know all that much about filesystems or disks.)
I agree. Most computer forensics people I have worked with, tended to
stick to what they considered to be "standard procedures" with
"standard forensics software". They were mostly ex-police with
computing training. I personally managed to get results which other
forensics teams could not (or would not), which I believe was because
I was willing to use some creative techniques that they wouldn't dare
come to court with.
As far as the data recovery industry goes, I think there are more
frauds than experts advertising such services.
Shane
