What risks are there if I dont consult a Computer Forensics Expert at the start of a problem?
The most frustrating aspect of forensic analysis is that the computers operating system randomly overwrites deleted data on the hard drive. This means that the longer a computer is used, the more likely it is that older evidence will be lost. Fortunately, the operating system frequently records evidence in several places simultaneously. So if the data is overwritten in one area, it may still reside in another. It is impossible to know, however, whether the data that is most important to you will survive the constant use of the computer. Indeed, the simple act of turning the computer on or looking through files can potentially damage the very data you are seeking. The dates that files were created can be changed, files can be overwritten and evidence can be corrupted. The safest practice is for us to acquire an image of the computers hard drive as soon as possible. Time normally kills the amount of deleted data that is recoverable.
A. The most frustrating aspect of forensic analysis is that the operating system randomly overwrites data on the hard drive. This means that the longer a computer is used, the more likely it is that evidence will be lost. Fortunately, the operating system frequently records evidence in several places simultaneously. So if the data is overwritten in one area, it may still reside in another. It is impossible to tell, however, whether the data that is most important to you will survive the constant use of the computer. Indeed, the simple act of turning the computer on or looking through files can potentially damage the very data youre looking for. The dates that files were created can be changed, files can be overwritten and evidence can be corrupted. The safest practice is to acquire an image of the computer as soon as possible; however, it may be possible to find relevant data even after years of use.
