To: Zakeet
The problem with this in digital forensics is that it’s hard to prove a negative. If, however, they only did a file system delete, the data may be recoverable, even piecemeal. That’s not admissible in court, but it’s damning evidence if retrieved.
Only a low level, multi-pass format of a disk is going to erase all evidence of the data. If they just literally pressed delete and thought it was gone, they’re in a for a rude awakening.
48 posted on
05/13/2021 2:43:06 AM PDT by
rarestia
(Repeal the 17th Amendment and ratify Article the First to give the power back to the people!)
To: rarestia
Only a low level, multi-pass format of a disk is going to erase all evidence of the data. If they just literally pressed delete and thought it was gone, they’re in a for a rude awakening.
The filenames for a bunch of the individual machines reports were shown to be deleted April 12. The master report appears to be completely gone, even though it is referenced as a destination in a number of files.
92 posted on
05/13/2021 7:33:24 AM PDT by
lepton
("It is useless to attempt to reason a man out of a thing he was never reasoned into"--Jonathan Swift)
To: rarestia
If they play their cards right, I’m sure they can get a copy from the Chi-Coms.
130 posted on
05/13/2021 1:35:25 PM PDT by
dsc
(Tu ne cede malis, sed contra audentior ito.)
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson