I should not have used the term wiped. To be specific, I meant the partitions were deleted in some cases. I had also used it to recover deleted files off of drives that still had operating systems functioning on them. All the data recovered was from free space. -----Original Message----- From: James.Holleyat_private [mailto:James.Holleyat_private] Sent: Monday, August 27, 2001 12:58 PM To: Rich Ostergard Cc: FORENSICSat_private Subject: RE: How to be a Computer Crime Investigator Rich, When you said: > I have had success with recovering > data off of wiped drives using power quest's > little utility "Lost and Found". Did you mean "wiped drives" where the data areas have actually been overwritten/wiped with a disk wiping tool? Or did you mean you were able to recover deleted files and fragments of deleted files from free space? I take it from the rest of the context of your post that you really meant you were able to recover deleted files and fragments of deleted files. James ============================== James O. Holley Ernst & Young Litigation Advisory Services & Computer Forensic Services http://litigation.ey.com Office: 703.747.1059 Fax: 703.747.0104 Pager: 888.620.5275 Pager email: 6205275at_private ============================== ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Aug 27 2001 - 13:50:51 PDT