Next week I have a special project queued up – an entire week of data recovery. That is I bought a stack of hard drives that were supposedly cleaned and I see how clean they actually were. This is probably one of the nerdiest things I have done for a long while and I am really glad to be done with it, stick around and see why.
See, I have Digital Forensics on my resume, because when I was in college I had the opportunity to take a brand new Digital Forensics class the university was offering. I took the course pass / fail (being a software guy, forensics did not fit into my course plan). I was proud that I had taken (and passed) that course. Then when the pandemic hit in 2020, I took (and also passed) a course offered by Sleuth Kit Labs to learn how to use their Autopsy forensics software to improve my skills.
In a job interview many years ago, the hiring manager asked why I had that on my resume. At the time I stumbled for an answer, but now, after all the training, I can unequivocally answer – that the next time you think a bit of electronic information is lost that at least 1 person has the knowledge and talent to recover it.
I am going to spend this next week attempting to recover some data using forensics tools. While I am at it thought, I am not using just one tool to recover things along the way, but I believe the spirit is the same between the tools … or at least the file recovery ones are concerned. The only difference is that the commercial tool recovers lost files, while the forensics tool ‘carves’ out the bits of files from the other bits on the drives. Come back next week for a wild adventure with interesting discoveries to be had.