I just received a call that a friend of mines uncle committed suicide. there are some unusual circumstances surrounding his death. The police informed the family that the uncle had left a note on the computer (a text file that was displayed on screen) but that they couldnt release the computer until the clean up crew went through. Something happened during clean up. something got spilled on the computer. The family has approached me, and asked that i do all that i can to recover that file. They are unable to pay the $5,000+ that the forensic recovery team quoted them, and so I have agreed to do all that i can. I have done basic data recovery in college. but im thinking that this might be beyond what i have done. I dont know the kind of shape the drive is in. I dont want to make a mistake and destroy any chance they might have to get some peace of mind and so i ask you all, "do you recomend any recovery programs, techniques, hardware, anything that might help me recover this file and give this family some peace of mind. please
Insurance? Get the police to pay to have it restored, its there fault. TBH if the drive is damaged then the 5k is probably a fair price if they are going to have to take the disk apart and recover it using forensic. How about the American pass time, sue the buggers, if any thing was a vaild suit this would be it.
First thing you want to do is try to mirror the drive (presuming it is still functioning), then do all analysis on the copy, you REALLY don't want to accidentally write any data to that drive, as when you do it is potentially overwriting recoverable data. For the analysis I'd use a live Linux CD like Knoppix STD which has powerful analysis/recovery tools. If the drive isn't even functioning, then you will need to physically remove the platters. This is very risky, and best done in a dust free lab environment. Failing that, you want to get an identical drive, and try to swap the platters, but like I say, that is a very delicate and risky operation. Good luck
unless the whole pc was left in a bathtub full of sulfuric acid i can hardly imagine a harddisk being ruined by some liquid that got spilled inside or on the computer - but if something is really that wrong with the disk, the responsible person for spilling stuff should pay the forensic company. (btw. 5k+ is too expensive imho. there are companies in austria that do it for $~1.5k - and only charge you if they succeed. and if they do it like that here i'm sure you can find a company with similar policies where you live too.) before powering up the disk in you should check it for visible damage. if it looks ok you could try to plug the powercable in and see if the disk is spinning. as long as there are no strange noises i'd say its worth trying to recover data yourself. if the disk isn't spinning at all you might want to get an identical disk and exchange the pcb. if it sounds strange you probably want to leave it to the experts
I have mirrored the drive. the mirror is proving to be little use as it looks like most of the files have been deleted. I use a Mac and the drive mirror is WinXp Home. does the cross platform really matter? is there anything i can use on my mac to try and recover the files? what im most interested is the last user created file on the drive. but spotlight is proving little help with that due to the difference in filesystems. do i need to get the mirror into a wintendo box and use windows to tell me the last user created file?
Spotlight should be able to pick up on metadata on NTFS volumes... open a Finder window and add a "date created is within the last X days" criteria to the search. If not... then adding it to a Windows box is probably your best bet. Sorry about the loss. Good luck with recovering the file.
and in a strange twist, the Internal Affairs devision of the police department paid me a visit, requesting the computer, the drive, any data i had taken off the drives and any notes i had made about their contents. so im kind of freaked out. at the same time releaved that its no longer something i have to worry about screwing up. Thanks for all your comments and suggestions. it helped
It seemed to me from the very first post that the problem is not a technical one. Especially since the question is what could possibly happen to a computer with such an important note on the screen. Also, the note should be on the pictures taken by the forensics team. Get legal aid, it sounds like you need somebody with some brute (legal) force to get some answers. Most important though, do not become overly obsessed. Deal with your loss with or without the note, but make sure you don't fall into thetrap of thinking that a note can give you closure. I wish you good luck and a lot of wisdom.
