Digital Evidence and Computer Crime, Second Edition

12.3 Data Recovery

One approach to recovering deleted files and folders on Macintosh systems is to make a clone of the evidentiary drive, connect it to a Macintosh system, and use tools like Norton Utilities, Disk Warrior, or ProSoft Data Rescue.^[2] In Figure 12.3 all of the deleted files found by Norton Unerase appear to be fully recoverable. Even when a file has a low chance of recoverability, Norton Unerase may be able to perform a full recovery.

Figure 12.3: Norton Unerase.

It is advisable to try several tools since one may recover more deleted files than others in certain circumstances.

Another approach to recovering deleted files and folder on HFS is to use EnCase. Some deleted files may be listed in the table view and others may be recoverable using E-scripts to carve files from unallocated space. Other carving tools mentioned in previous chapters, such as foremost on Linux, can be used to recover files from unallocated space.

^[2]http://www.prosoftengineering.com