Having no experience in computer forensics, I'd like to know whether it's possible for someone to track if a laptop's HDD/partition has recently been formatted OR had a ghost image deployed.
Any ideas/tools/methods would be appreciated.
Having no experience in computer forensics, I'd like to know whether it's possible for someone to track if a laptop's HDD/partition has recently been formatted OR had a ghost image deployed.
Any ideas/tools/methods would be appreciated.
There is a massive number of data recovery software including:
I have used Recuva for many of recovery tasks. It's lightweight, powerful and best of all free! It is only short sight is that it may not recover full files. If it is really important information you could always seek out professional help which, while being incredibly expensive, is often the most effective way to recover data.
Hope this helps.
You don't need any tools to see if a disk have recently been formatted. Most filesystems have creation date, modification date and access date for their files. Do a quick search for all files, and order by modification date, and you will have a good guess when the disk was last formatted.
When you say "ghost image deployed", I assume you mean they have installed a ghost image on a disk. If you check the system logs for login entries, you will be able to roughly guess when a ghost image have been deployed. If there is a ghost image, you can expect that there will be a gap in the log entries where no activity have occured, to when the user of the system regularly logs in. This is a good indication that either the system has been unused for a period of time, or if there has been deployed a ghost image.
my understanding is this:
'recently' formatted, no (perhaps unless the drive is in usage since then). formatted at some point in time, yes. Typically a 'quick' format will wipe the index tables of the drive partitions but leave the files intact, so you know there has been a format. A full partition format (in theory) will result in the drive being returned to a blank state but the partition tables will still be intact so you'd know the drive either hasn't been used since then or that a format has happened. You may also find data on areas left un-partitioned from previous usage. you may also be able to go on surrounding evidence, e.g: if this drive is known to have had a recovery partition on it when issued and is now partionless and blanked, of if the drive is totally blank but the SMART data on the drive shows it's been used.
a ghost image application is harder to tell. If you have the original image you can hash the drive and see if it matches the image exactly, which would be highly unlikely if not for an image being applied, but once data has altered on the drive you have little more than circumstantial evidence that the two just happen to be the same. You'd do best to look for data on the drive like product keys and timestamps on certain files at that point.
This is how i understand it and it may well be incorrect, I'd appreciate feedback.
Using software such as Encase or Autopsy might be of use, as it will allow you to check the unallocated cluster. This might potentially show you a large amount of information that has been "Formatted" or deleted. This is due to most quick formatting just hiding the information and allowing for it to be overwritten by new files on the drive.