Forensics/Data Reco...
 
Notifications
Clear all

Forensics/Data Recovery Business

14 Posts
8 Users
0 Reactions
898 Views
(@adamd)
Eminent Member
Joined: 19 years ago
Posts: 46
 

Data recovery and Computer forensics isn't about software. I'm kind of amazed your asking this question if your moving into this field.

Having done the course, I'm a bit shocked that people consider they are ready for real world Computer Forensics with only a GCFA.

My advice is don't stop your training there, if your going to sell data recovery as a service, you should learn about it.


   
ReplyQuote
4Rensics
(@4rensics)
Reputable Member
Joined: 16 years ago
Posts: 255
 

What training would you suggest? What more can you learm about Data Recovery? Do you mean hardware and fixing drives, as menioned previously, this is an expensive side of data recovery to get into as often the equipment runs into thousands and thousands to purchase!


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

There are two related sides to data recovery

The first is physically reading sectors from a disk. On some disks they read 100%, other times a few or very large number are unreadable. The large number indicate that you may be into expensive physical recovery methods, such as head swapping

The second is logically decoding these sectors. This can because sectors are missing (see above) or the file system has been corrupted, partially overwritten, deleted, operating system reloaded, partition sizes changed etc etc.

The training, or learning you require for this is knowledge of file systems. How to logically read a file when lots of useful information is missing. Which tools to use, and knowing when the results are correct.

Start with NTFS and FAT, the starting looking at the various flavours of Unix/Linux. This will keep you busy for a few months.

The next stage of knowledge is file structures. Data carving works for unfragmented files, but to join fragments together is a skilled job.

Never stop leaning!!


   
ReplyQuote
(@adamd)
Eminent Member
Joined: 19 years ago
Posts: 46
 

As Michael says, learning file system fundementals is a great start. You should have got Brain Carrier's File System Forensic Analysis book with the SAN's 508 course which is a good book to start on (though not referred to enough in the actual course when I did it a few years back).

Youtube can be a great place to look for the hardware side of things ..nothing beats hands on experience with drives/media. Pull apart some old drives, see how they work interally, follow some of the walk throughs for swapping head assembly's and similar techniques that are on the net.

Training courses like the advance X-Ways ones give great file system knowledge also.

In the end, nothing beats hand on work ..test out as many tools and techniques you can.

Good luck!


   
ReplyQuote
Page 2 / 2
Share: