Data Recovery and Its Role in Computer Forensics - Kevin Ripa
18 Apr 2012
This is my favourite presentation so far. Kevin runs a data recovery business and takes us inside his home lab to show how things are really done. Along with giving a review of the different recovery software, a look inside the best home office I have ever seen (I made my wife watch so she can get some ideas of what a real home office should look like) he also walks through the data recovery process. There is so much misinformation about this out there it is great to get the real facts.
Data recovery (the repairing of hard drives, not getting files from a forensic image), is a mostly misunderstood science. This presentation will go through the various types of recovery available, as well as what you can do yourself and what you can't. We will discuss the various things that can go wrong, how to diagnose them, and we will be dispelling myths surrounding data recovery, including the often talked about 'just put it in the freezer' technique. We will be explaining the OS of the hard drives themselves, breaking TPM or hard drive lock passwords, P Lists, G Lists, (think you really wiped everything on that drive?) as well as the differences between the small computer shops that advertise data recovery, and the real science of data recovery in a clean room lab environment. Kevin's company: http://www.prodatarecovery.ca/