How does computer forensics differ from data recovery?
The goal of our data recovery procedures is solely to recover the files and folders lost due to a computer failure, unintentional deletion, or other unexpected circumstance, without monitoring the usage of the computer. Generally, data recovery could be considered the first step in gathering evidence in a computer forensics investigation. When digital media is imaged (an exact replica of the original), all files and folders are recovered along with deleted data. Also, the ability to view any hidden or unpartitioned space is gained as well. Computer Forensics is a service that is concerned with providing evidence (or proving a lack of evidence) regarding how a computer was used, what files were accessed and at what time, and who had accessed them. Computer Forensics investigators are able to find, assemble, analyze, and explain large amounts of digital information that would not be particularly helpful for data recovery services, but are invaluable in a court of law.
