The time may come when you need to examine a hard drive either because you need to recover some lost data or because you suspect an employee of a violation. Whether you intend to use your findings in court, for employee discipline, or just for your own information, using a good forensics tool and recognized forensics techniques will help you both recover your data and preserve its value as evidence. A tool I recommend is WinHex…
