Getting Back Deleted Files

It is a fact that criminals frequently attempt to destroy evidence. And this is also true with computer crimes. The criminals may delete files. However there are a variety of tools you can use to recover such files, particularly in Windows. Disk Digger is a free tool that can be used to recover Windows files. This is a very easy to use tool. There are more robust tools, but the fact that this is free and easy to use makes it perfect for students learning forensics. Let’s walk through its basic operation.

On the first screen, shown in Figure 14.1, you simply select the drive/partition you wish to recover files from.

Figure 14.1. Add a new scan.

On the next screen, you select the level of scan you want to do. This is shown in Figure 14.2. Obviously the deeper the scan, the longer it can take.