What risks are there if I don consult a Computer Forensics Expert at the start of a problem?
The most frustrating aspect of forensic analysis is that the computer’s operating system randomly “overwrites” deleted data on the hard drive. This means that the longer a computer is used, the more likely it is that older evidence will be lost. Fortunately, the operating system frequently records evidence in several places simultaneously. So if the data is overwritten in one area, it may still reside in another. It is impossible to know, however, whether the data that is most important to you will survive the constant use of the computer. Indeed, the simple act of turning the computer on or looking through files can potentially damage the very data you are seeking. The dates that files were created can be changed, files can be overwritten and evidence can be corrupted. The safest practice is for us to acquire an image of the computer’s hard drive as soon as possible. Time normally kills the amount of deleted data that is recoverable.
