Deleting Data/Recovery
Recovery
- Subsections
Add or edit subsection:
| Minimum time | 30 |
| Maximum time | 60 |
| Position |
5/1 |
| Type | Lesson |
| Section of | Deleting Data |
| Lang | En |
- Last modified: 6 August 2013 17:18:21
Demonstration
Explain the consequence of standard delete procedure on Windows OS. Demonstrate file deletion from a computer, USB memory stick, digital photo or video camera (using flash memory). Display the deletion on the projector or on the digital device to the participants. Install and run Recuva (or similar software) to retrieve the deleted files.
Trainer's notes: You must test this in advance as often, OS irregularities prevent the discovery or recovery of deleted files. However, in most cases all of the examples above work smoothly. Other tools to use could include http://www.handyrecovery.com, http://www.officerecovery.com/freeundelete, http://undeleteplus.com/
Note that free undelete tools are much much less advanced than proprietary services, especially laboratories that specialise in data recovery. You should stress to the audience that damaging the media device will not erase its contents and a dedicated laboratory will be able to restore it. Only overwriting digital data with other data is an effective method to wipe its contents.
Its advisable to run the undelete software from the computer itself, not a portable version.
Demonstration
It is also possible to suggest using data deletion and recovery as a strategy. For example, photos taken during a protest on a digital camera can be deleted by the photographer who is expecting a search of his equipment. Arriving home, the photographer can undelete these photos using one of the above tools. It is important to stress that once deleted, new photos should not be taken on the same advice as they will overwrite the wanted material.
Exercises
- Participants are asked to create documents on a USB stick, delete it, then restore it
- Participants take digital photos on their camera or mobile phone, delete them on the device itself then attempt to recover them
- If using rented or public computers, participants can spend some time looking for 'compromising; material deleted on those machines
