Resurrecting the Dead: Recovering Wiped Files Using Windows Search

Author: Elluma Discovery

It's an electronic discovery nightmare. After months of fighting to gain access to the other side's ESI, you learn that the key evidence you've been hoping to find was deleted. Worse yet, the data was wiped—rendering it unrecoverable by normal forensic techniques. What can be done? If you're lucky, a handy little Microsoft feature called Windows Search could save the day.

I was recently involved in a case just like this. The user of the computer in question was fairly savvy with technology, and he wiped all documents, email, and other user files from his computer before handing it over for discovery. He made a giant mistake, though. He failed to wipe an innocuous looking file called "Windows.edb". This little file happened to be the key to the case.

So what is this "Windows.edb"? It is the core of Windows Search, a piece of Windows that allows you to search your entire computer instantly. Type in a word, and Windows Search will immediately show you every document, email, and media file that contain that term.

In order to make the search instantaneous, Windows works in the background to create a gigantic list of every user-generated file on your computer and the contents of that file. This gigantic list is called an "index", and it is stored in "Windows.edb". In essence, this one file contains the text of every single user file on your computer.

Even though our tech-savvy user had successfully wiped all his files from the computer, it was possible to rebuild almost everything from the "Windows.edb" file he had failed to delete. Using a special set of tools, over 50,000 documents and emails were extracted. Even better, the tools extracted metadata—timestamps, author information, and more.

When it comes to getting evidence from Windows Search, however, speed is of the essence. Windows Search continually re-examines your computer and updates "Windows.edb". When files and emails are deleted from the computer, they are eventually also removed from the index. Thus, if a computer is left in use, evidentiary gems maintained by Windows Search will simply vanish.

If you believe that key evidentiary information has been deleted from your ESI, don't panic—think preservation. If the computer is powered off, make sure it stays that way. If you have control of the computer, sequester it so that no one will be tempted to turn it on. If the computer is still in the hands of the other side, draft a preservation demand that dictates the machine may not be turned on.

Even after wiping, Windows Search might still contain critical evidence for your case. With proper preservation and the right tools, this evidence can be brought back to life.

 

Article Source: http://www.articlesbase.com/data-recovery-articles/resurrecting-the-dead-recovering-wiped-files-using-windows-search-4341048.html

About the Author

Elluma Discovery provides computer forensics, electronic discovery, forensic data recovery, forensic analysis and computer expert witness services.

Nokia N8 - To Fill The Soul With Joviality

Author: Adam Caitlin

I am really very much delighted after owing the Nokia N8 one of the best Smartphone I ever used. There are loads of features which makes me feel proud and among them the best one is the Camera which is of 12 mega pixel and is with the Xenon flash which makes it more special. Through the Camera there is very outgoing thing with which I can keep the record the name of the place at which I had the pics, Videos etc so that whenever I go back to those lovely memories recalling the name of the place will be so easy. The internal space is of 16 GB which is quite an appreciable amount but then also there is the memory card slot which which the space can be level headed to a better way.

The only depressing thing with my Nokia N8 is the Symbian OS platform because of which sometimes the phone get freeze other then this there are no regrets with this. The color of my Smarty phone is Orange but people can have several other colors like the Dark Grey, Silver White, Blue and Green. Whenever i need to go out for vacations at any of the place I load lots of movies, Videos etc which is the best time pass for me.

At the time when I was planning to purchase this phone there were so many Nokia N8 deals which are attractive enough and among those I chose the Contract deal as there with this I can make the payments of my mobile phone bills at the last of the month with gifts like free laptops, free DVD Player, free Digital Camera, free Play Station, free Nintendo Wii, free Xbox games etc. There are incentives also like the free messages, free monthly minutes, Internet allowances etc and the best part is to have the Nokia N8 free of cost with this deal.

Article Source: http://www.articlesbase.com/cell-phones-articles/nokia-n8-to-fill-the-soul-with-joviality-4332834.html

About the Author

Adam Caitlin is expert author of Telecommunication industry. For more information On Nokia 2720 Fold deals and Nokia 2730 Classic Deals in UK, visit our online shop Freecontractmobilephone.co.uk

BlackBerry Torch 2 Updates RIM's Popular Touchscreen Handset

Author: Reg Spencer

One of the most important innovations in the mobile phone industry has been the launch of the BlackBerry Torch, which was the first phone to be fusing the touch screen display and the full QWERTY keyboard in one great package. Now, BlackBerry are looking to emulate themselves with the launch of the Blackberry Torch 2, which is going to be the next phone in the Torch series. Even though the exact name with which it will be launched finally in the United Kingdom has not been revealed, it is expected that this will be the name by which it will be called for most of the time before its launch.

The Blackberry Torch 2 will be featuring the much improved feature list than the BlackBerry Torch. Firstly, it will be beginning with the 3.2 inch touch screen display that will be having much better resolution than the previous BlackBerry Torch. This screen will be having a resolution of close to 480 x 640 pixels, which puts the new phone in a different league when compared with the predecessor. Also, by virtue of being capacitive, this phone will be able to support multiple touches and the high resolution screen only serves to make it look even better. The presence of the full QWERTY keyboard in the phone will not be revealed until you slide the keyboard underneath the touch screen display in the portrait mode. This method is extremely similar to the previous phone and so is the keyboard.

Even though the phone seems to have got a much needed facelift in the form of the keyboard looks, the materials that are used in the keyboard are the same high quality materials that were previously seen in the BlackBerry Torch. The internal memory of the phone will be 8 GB and this can be used to show the multimedia capabilities of the phone in the best possible way. Even though this is going to be mainly used as a business phone, it is still capable of entertaining due to the usage of a fantastic media player in the phone. Apart from playing a number of formats, it will also be getting full use of the 1.2 GHz processor that is used in the phone. This is an extremely powerful processor and this finally brings the BlackBerry phones closer to the tablet PCs of today. This powerful processor will be aptly running the BlackBerry OS 6.1, which will be used in the Blackberry Torch 2 for the first time.

While the difference is between this operating system and the OS 6.0 seems to be extremely limited, it is expected to be better than the predecessor nonetheless. The new phone will be coming with a five megapixel camera that has the all the features that are necessary to make everyone go wow. Some of them include the likes of the image stabilisation and LED flash. The exact launch date of the phone has not been revealed by BlackBerry and so are the prices.

Article Source: http://www.articlesbase.com/cell-phones-articles/blackberry-torch-2-updates-rims-popular-touchscreen-handset-4337692.html

About the Author

At Best Mobile Contracts we compare Blackberry Torch 2 deals from all the major online retailers.So if you are looking for a BlackBerry Torch deals 9800 on Vodafone, Orange, O2, Tmobile, 3 or Virgin Mobile, we are sure that we can help.