Computer Evidence Recovery

Sunday, 1 September, 2002
Uncovering a computer’s secrets

Back to section index

A hard drive can contain crucial evidence

BBC World ClickOnline’s Mark Eddo discovers how easy it is to find data on a hard disk even if it has been deleted or reformatted.

As the list of corporate scandal grows, so too does the mass of digital data investigators have to wade through. This is where computer forensics experts come in. Their task is to help retrieve information regardless of how well it is hidden.

"Computer forensics can play a very important part in that process," explained Peter Yapp of Control Risks Group.

"But of course it’s not the full story because you still need to combine traditional investigative techniques, such as interviewing and sifting through documents, with computer forensics.

"What they have to determine is the extent to which the controlling mind of the company, the directors, knew what was going on, because the fifth amendment has been pleaded so they’re not going to say a great deal to the regulators at the moment," he said.

No hiding place

Just pressing the delete key on the keyboard will not destroy compromising files.

Computer forensics experts are so thorough that it is virtually impossible to destroy data once it has been saved on a hard drive.

And the task becomes even harder if the computer is on an office network.

"You may be able to control what’s on your computer, and you may do your best to delete things and cover them up, and even then you’re unlikely to succeed 100%," said financial fraud investigator Simon Dawson.

"But as soon as you attach your computer to a network there are a whole load of other places that information could be stored so potentially it could be anywhere throughout the world."

"If you want to destroy sensitive information on a computer, you’re looking at total destruction of that hard drive as the only 100% option," he said.

Some 40% of the cases involving computer forensics techniques are related to child pornography.

The other 60% are divided between workers’ misuse of company computers, intellectual property and fraud.

In the current climate of financial irregularity, computer forensics labs are likely to be kept very busy.

This story can be found at http://news.bbc.co.uk/1/hi/technology/2226182.stm

Back to section index