At work, we had a PI come in and drop off a computer (laptop) to us. He said this was part of a divorce case, and the wife wanted us to look for any incriminating evidence. But she couldn't start the computer. When I booted it up, the message "bootmgr missing" came up. So we took the hard drive out, and put it in another drive to see if we could recover any data. It was wiped. But......that's not where the story ends. Using a tool that recovers data that is deleted, as long as the sector wasn't over written, we have, to date, recovered over 30 thousand files. Many .doc, .txt and .jpg files. I think that hubby is going to be quite upset after the process is done.
Comments
Viscera
I would pay real money to be allowed to be in the court room when the data is entered into evidence when this guy thought it was gone forever
djskitzy
what sort of stuff is in there? just be general if you have to, but exact if you can... 
Lurker
Should have used D-ban, or kept the hard drive. Read this article last week and laughed my ass off.
http://www.howtogeek.com/115573/htg-explains-why-you-only-have-to-wipe-a-disk-once-to-erase-it/
Viscera
my job would have been considerably more difficult if he had done that (or easier, depends on your perspective, lol)
griffin
Remove the covers, and take out the magnets which are really strong and fun to lay with, then remove the platters and smash them to bits (if they have a glass substrate) or bend them and drill them if they are metal.
Flee
im confused. .doc, .txt, and .jpg are all evil "up to no good" file extensions?
I would be more concerned about emails, etc.
Flee
Also, being the PI dropped it off, and it is the husbands PC, do you have consent to do what you are doing, and how likely is it going to be allowed in a court? The PI "stole" the laptop, and is accessing personal files.
There have been a TON of legal issues with accessing another persons computer these days. If I was the store owner, I would have contacted the husband or turned the PI away. If it turns out you are breaking a law by doing this, you could be saying goodbye to your store.
Viscera
it was the daughters laptop as it turns out, and after recovering the HDD, nothing but teenage girl stuff, sneakers, and stuff 15 yr olds like. Why the guy reformatted it, hhmm




