Computer Forensics - What happens when you delete a file?

[chidoTV]

i want to get into this field. is this a good career?

[MrHyperspaceman]

Sooo thers GHOUSTS IN COMP ?!!!

[labobo]

toobin151 are you talking about FAT because that's not how NTFS marks a file as deleted

[Chasabi]

Great video. Thanks

[runescaperocx]

What about formatting? Does that delete it?

[Finchpcrepair]

@runescaperocx Not completely. You can format a hard drive and still find most of the files with the right software. Using something such as DBAN, you can totally erase all files. It would take a professional company a lot of time to recover the files, if they can even do that at all.

[runescaperocx]

@Finchpcrepair Oh wow! I want to learn how computer forensics works so I can get my old files if my hard drive ever dies... Instead of charging an entire company to do it lol... And if I am going to be making my webhosting company in the future it would be useful to know this stuff :D

[indianindianindian9]

CCLEANER

[JackHaynes30]

can a computer forensics expert see stuff that has been overwritten?

[tuzathedarknight]

I use the tune up shredder. That does delete it

[IFightGangs]

Thumbs up on a nice video with quality information. Thanks for uploading this video.

[MegaAkad]

Ccleaner 35 passes

Helped me :) no files were recovered after :)

[song110beforgiving]

The way I understand it is, you can't erase things but you can only overwrite them; is that true??

[pzmtuthcvpvl]

@song110beforgiving In the general case that is true - since we did not build the machine nor design it we do not actually know what is going on ~ why M$ ( whatever ) is "slow" is because you work at real-wold responses and those who use that "soft-ware" have response rates based on phenom reported by Phii in his M.I.T. Press book on P.G.P. ~ which read rather than telling me ... the way to "delete" a file is open with programming code / re-write all the characters / close the file ....( pm me )

[wallysboyfriend]

If that's true then that explains why ms office is slow. Why should it use a temp file when it should be using ram for everything you type before you save it.

[SuperJadeDragon]

So what program can you use to delete all the main and shadow etc.. files you mentioned?

[anzwertree]

This is why I was able to save my friends files when her system kept restarting. I was sure her files were still there. Windows XP wouldn't load, but I was able to boot from a Live Linux CD. Then it was a simple process of mounting Windows NTFS from the shell. Save her files to an external hard drive, reinstall Windows. Bam. Maybe I should become a forensic specialist too

[2phat4u2]

@anzwertree

lol, That's computer repair not computer forensics. Forensics, lets say in this case of a deleted file is where maybe I person had child pornography and deleted it and is now being charged you can still go in and find the file that was deleted. That being in a perfect situation scenario and a easy case.

[anzwertree]

@2phat4u2 You do realize data recovery is a central part of computer forensics, right? In fact... you just mentioned that, thus unknowingly supporting my initial statement. Yes, I did "repair" her computer. If by "repair" you mean recovering data. I was unaware we were playing semantics here, though. Maybe you are unfamiliar with commercial data recovery. We use some of the same tools as forensic analysis. Perhaps you should study up on overlapping fields between professions.

[2phat4u2]

@anzwertree

fo·ren·sics (f-rnsks, -zks)

n. (used with a sing. verb)

1. The art or study of formal debate; argumentation.

2. The use of science and technology to investigate and establish facts in criminal or civil courts of law.

Semantics indeed my friend. I didn't say that they don't use it, just the way you used it was computer repair.

[anzwertree]

@2phat4u2 Okay, and please tell me why exactly you are telling me this is? What part of my comment said computer forensics is the same thing as computer repair? The field of forensics and data recovery can also be applied to computer repair. So what? Holy Jesus tapdancing Christ! Imagine that. Fields of study overlap. Seriously, dude, whats the deal? Is it an insecurity issue? Are you trying to impress other commenters that you can read a dictionary? Do you want to compare penis sizes too?

[2phat4u2]

@anzwertree

Haha it didn't, and no its not insecurity or a cry for attention. I took your comment out of context and was offended. On a side note, well played you made me laugh which is a first for a flame battle. :D In all fairness I know where you are coming from I just wanted to hassle you a little for some fun.

[anzwertree]

@2phat4u2 LOL, yeah, well.... I'll be honest. I stole that last comment from the Atheist Experience

[xJSLRx]

I seem to have a redirecting virus or somthing. keeps taking me to randome bs. so I deleted everything exept the OS, then I went to nasa.com and found the biggest pic of the univeres I could find and made like 500 copies in a folder, then I made 5 copies of that folder, and made many more untile the hdd was full. Wont that erase everything?

[pzmtuthcvpvl]

@xJSLRx at least that is a thinking approach, usually such approaches are circumvented by controls in the machine that are designed such that data can be recovered - those tools get subverted to advertising and other justifiable reasons that may not be justifiable under your needs -- basically a complete re-install of the operating system is the minimal way to rid the machine of that but even then various installers try to go find lost data for you - thus the thing is still there

[scilonthreat]

scrub 2.1, uses DOD and NNSA standards, plus it's community developed free software.

[628peeps]

I use a hammer

[FLStudio4512]

comodo is a free antivirus i use it

[sotsosts]

I'd like to work with that for a living :)

[sof2finchy]

i use c-cleaner, 35 overwrites, so im fine, but thanks for your concern.

[NiGhtMarEs0nWax]

toobin151, can i ask youa question?

what are the name of these temporary files? i mean, i would like to google to do a bit of research, but temporary files or shadow documents are unlikely to turn up useful or relevant information. thanks. :)

[prueunknownsoldier]

how can u manually remove viruses? my computers really small and doesnt have a CD drive so i cant run any anti virus programs..and i dont want to download any because my mom told me that they come with a ton of viruses that way u have to buy the whole 300 dollar program..which i dont have that kinda money...so i could REALLY use ur help...

[Amathian]

uhm your mom is retarded

[prueunknownsoldier]

no she's not...i think she actually might be right...i mean companies r just interested in money..and anything u do download from the web do carry viruses...

[NiGhtMarEs0nWax]

download avast, its free, professional and 100% no viruses lol, google "avast shedule boot time scan" and shedule a boot time scan, that is teh easiest way to do it. you have to register for a free cd key first and its not 100%, but unless you wan to get your hands first and do a bit of background research, you wont be removing any viruses manually. avast has a 90% success rate i would say.

[scilonthreat]

Ubuntu

[panthrfan1]

I shred most anything personal

[batfink161]

windows pretty?

fuck off xD

linux ftw

cli is much more pretty

[nilknarf1977]

That is wonderful, I already know how powerful is enCase. Steve, thanks for sharing this with us.

[99mees]

would you help me with a major problem?

installed a second HD. entered bios, put that as primary, and installed winxp from 98. unfortunately 2nd HD had 2 partitions, and both took control of other(main) HD and it has same install as 2nd HD. now comp sees 3 HDs. which appear to be apart of network. i don't know which HD is controlling the network. can't uninstall because add/remove progs don't list winxp. my 1st folder (from 1st install) is there but can't access it. please help

[ALUMINUM20]

Isnt the directory entry only for FAT filesystems? NTFS uses the MFT and serves a similar purpose. Great vid :)

[ramjet2012]

very informative. I did not know how it worked.