Recovery of deleted data, totally or partially, from physical media

Sometimes, the information stored in storage devices can be lost suddenly, requiring the application of computer forensic techniques for its recovery. These techniques can be applied to different types of media such as hard drives, USB sticks, digital cameras, CDs or DVDs, among others.

The simplest way to prevent data loss is to frequently back up your information. Generally, the devices give signals of a malfunction that can cause the loss of information. For example, a slow boot, unexpected shutdown or restart, some programs stop working, the device frequently overheats easily or makes strange noises.

When information is lost, it is not immediately removed from the storage device. Initially, only the references to them in the directory structure are eliminated, leaving the space they occupied available for overwriting. For this reason, it is strongly recommended to stop using the storage device so that the data to be recovered is not overwritten.

In most cases all or part of the data can be recovered. Unfortunately, if the device has continued to be used for a long time, it is very likely that the data has been overwritten, making it impossible to recover.

At FORENSICTECH, we have the necessary material to try to recover all your data. Remember that it is vitally important to stop using the storage device.

Considerations

This type of evidence can be contested and therefore, rejected, ruining the entire procedure. To determine whether this type of evidence can display probative value, the forensic analysis of a certified computer expert is essential.
 
Likewise, we must bear in mind that in recent years, the number of works and computer expert opinions that are dismissed in litigation and are not taken into account at the time of sentencing. The reason is none other than a huge increase in the number of computer experts who are not legally authorized to act before the courts, and who therefore incur in the crime of professional intrusion. We can find a clear example in the Judgment of the Superior Court of Justice of Madrid 531/2017, Social Chamber, Section 4, July 19th , 2017, in which it is stated in the first point of the grounds of law, that:

“The appealed ruling is essentially based on the ineffective and invalid expert evidence that has been provided as the only justification for the facts imputed in the letter of dismissal to the plaintiff, for several reasons explained by the Magistrate of Instance in her ruling. The first is because she understands that the expert presented by the company lacks an official degree in computer science, although at this point it is recognized that the expert is the person who provides computer assistance to the company as a freelancer, which implies at least a practical knowledge of what he is hired for. On the other hand, the informal nature of the expert evidence and the questioning of the chain of custody are argued. Special mention is also made of the breach of the guarantees of the plaintiff’s right to privacy at the time of carrying out the inspection and search of the computer equipment, declaring it proven that the plaintiff was not present. In short, the Magistrate of Instance, evaluating this evidence and the testimonies provided at the oral trial concludes that the defects in the practice of the expert evidence carried out by the company prevent granting probative value to this means of proof, and given that it is essential to prove the facts imputed to the plaintiff, declares the dismissal unjustified.”

The computer test must be certified in a computer expert opinion, prepared by a legally qualified computer expert. In our Frequently Asked Questions section you can find more information about it.

Why hire our services?

From FORENSICTECH we provide our clients with the security of having:

  • A computer expert specialized in your case, collegiate and legally authorized to act in the Spanish courts of justice.
  • Appropriate instruments and specialized software to develop your expert report.
  • Legally recognized chain of custody investigation and assurance methods.
  • An effective and efficient work in the requested expert report.
  • A certified computer expert opinion, which greatly increases your credibility and reliability before judicial bodies, as it is endorsed by a professional association.
  • A computer expert capable of facing the ratification in oral proceedings in all jurisdictional orders.
  • Our performance in all the courts of justice throughout Spain in all jurisdictional areas.

SUBSCRIBE

Receive the latest news by email
Remember that you can unsubscribe sending an email to info@forensictech.es
Skip to content