How Private Investigators Can Discover Digital Data You Thought You Had Lost
How Private Investigators Can Discover Digital Data You Thought You Had Lost.
Losing data isn’t good when you realise you need to access that on your computer. There’s also times when it’s a golden ticket for fraudsters to harness your confidential data, steal it right off the hard drive, and you’d be none the wiser.
Other times, there are deliberate actions that can be taken to ensure data is permanently gone, or tweak the technology slightly to ensure nothing is ever wiped clean automatically.
Lines of code are all that control every piece of digital data.
Know the code, you can know a lot of information you wouldn’t otherwise have.
This same type of knowledge is what enables detectives and private investigators to peek inside of devices thought to have been scrubbed.
However, it’s not always the case you’ll recover data. The trick to knowing if your data is recoverable rests with your knowledge.
In technology terms, it’s acronyms for everything. Here’s what those are:
- SSD – Solid State Drive
- HDD – Hard Disk Drive
HDD storage media is the problematic one because it uses magnetic media. Every time the processor is running, data is being written to the hard drive using binary code (1s and 0s). The only true way to be sure data is destroyed on a HDD is to install software specifically to write to the hard drive.
Since the data is recorded in binary code, software is available to install on devices specifically to rewrite over existing data and change the order of the binary numbers, which in essence corrupts the data files making it impossible to recover because the original binary code is no longer available. Not even in back up files, unless they’re backed up through cloud services such as Dropbox.
It doesn’t matter whether it’s a mobile phone, tablet, laptop or tower. There’s one type of drive, and depending on the type and if it’s been customised, there could be more than one drive installed.
HDD is the problematic drive for data protection. The information is recoverable from the drive using data recovery software to find deleted files, or rewriting software to write directly to the hard drive, corrupting the binary codes to destroy data.
SDD isn’t always a fail-safe though because of the Windows TRIM command
Know the way you’re always hearing advice from tech experts about the importance of keeping software updated?
It couldn’t be truer than when you’re dealing with your Windows operating system.
The TRIM command is a feature used in Windows using Solid State Drives. When you delete a file, it automatically trims the file to free up memory space. Since that’s done as soon as you click delete on a file, that file is then corrupted and irrecoverable. The caveat is you need to be running Windows version 7, 8, 8.1 or 10.
The TRIM command is not supported in Vista.
For computers using the Vista operating system with SDD, data isn’t removed automatically so it may be recoverable. For all other operating systems, especially if you’ve bought a second-hand laptop or other device with a buyback arrangement when you want to upgrade. Don’t fall for that scam because the TRIM command can be disabled.
Here’s how to check your system is truly deleting data:
- Ensure you are logged onto the system as an administrator as you do need Admin privileges to run this command.
- Windows 7, 8, and 8.1 – open the Start Menu and type command in the search field.
- Right click and select run as administrator
- You may be prompted about changes to your computer setting. If the pop up activates, select yes to allow changes.
- Copy the next line of text exactly as it is…
fsutil behavior query DisableDeleteNotify
- Paste that into the command prompt screen
- Hit enter
- If the TRIM feature is enabled (which you want it to be) it will display under your command prompt that you pasted in to show the text DisableDeleteNotify = 0.
- If the zero value is replaced with a one, then when files are deleted, they aren’t entirely. If that’s the case, the command prompts to enable and disable the TRIM command are:
fsutil behavior set DisableDeleteNotify 0 (enables TRIM)
fsutil behavior set DisableDeleteNotify 1 (disables it)
Realistically, there’s no reason to disable the feature, unless of course, you suspect something and want or need to know. As an example, if you want to keep a closer eye on your kids by finding photos or videos snapped by the webcam and then deleted from the system. By disabling TRIM, you’ll be able to use software such as Recuva, or other data recovery software.
Knowledge truly is a powerful thing.
An important disclaimer: X Three Surveillance is in no way advocating the use of Windows TM TRIM Command, or other snooping techniques for deception, fraudulent or other unsavoury purposes. There are legal considerations with respect to people’s privacy rights and data protection laws to protect data.
Do not tamper with computers in your workplace!
Should you really need to access digital data for peace of mind, or any other reason, consult with someone who knows the legal ins and outs of investigations. Otherwise, the information above is intended for your personal use, giving you more control over your confidential information – in particular when you’re getting rid of any equipment that has a hard drive installed.
Wipe them clean always before discarding them.
