Hi all, first time user here great to meet you all.
I'm new to the world of ..this sort of thing and had a question. As part of an assignment for a forensic course at my University, i have been tasked with recovering files from a USB stick using Recuva Portable. The assignment has gone as such thus far: The files were supplied to us in a ZIP, we extract them to a USB provided to us, we are then instructed to delete the files from the USB and recycle bin, and then use Recuva to retrieve them.
So far so good, i was easily able to recover the 15 files (14 jpg and1 doc) with a simple scan and all were successful.
The problem i have been met with is step two, which involves the following: First, we format the USB a few times, then we again extract the files from the Zip directly on to the USB. After this we then format the USB again, with all of the files still on it. After that (including emptying the recycle bin) we are asked to again recover the files from the USB using only Recuva.
I have tried almost every option my limited knowledge can imagine. I have ran scan's with all of the options in advanced mode ticked off,i have deep scanned the heck out of this USB, and have even scanned the recycle bin (which only brought me all of the .lnk versions of those files).
I want to believe its my own incompetence and not the professor putting an trick question on our assignment, however i don't see what i have done wrong or could do next. Given the stipulations (retrieve the files, no programs outside of Recuva) does anyone have any suggestions on what i could do at this point.
Thanks in advance, cheers to all of you
Your friend, the waning hope of a Forensic course student...YellowRose
Yes, I should find a comfortable chair, sit back with your eyes closed, and mull over what you have been told, what you have read, what you know about file systems, what you know about flash drives, and come to the conclusion why you think you can't recover the files.
It's what most of us have done, you will learn far more this way, and your professor won't come round and break our fingers.
Yes, I should find a comfortable chair, sit back with your eyes closed, and mull over what you have been told, what you have read, what you know about file systems, what you know about flash drives, and come to the conclusion why you think you can't recover the files.
It's what most of us have done, you will learn far more this way, and your professor won't come round and break our fingers
Although i appreciate your straight shooter mentality, i don't think that's quite fair of you because you paint a history of learning that I haven't had nor do you understand the mentality of the project. In other words, no finger breaking will occur - our past projects have allowed us to seek information and help from any and all sources, including websites and forums. In fact, our mach role as investigators have involved us using all of our resources and thinking, my last project i queried a software company on some of the ways their product differed from competition. Furthermore, this isn't a computing science course - our learning has not been on the technical side of computers but merely how computers are used in criminal and civil forensic investigations, the very legal side of things, so our knowledge of file systems, flash drives are likely just above the average student at this point. Im not saying the project is unfair, but its unfair to assume i'm being lazy and looking for an answer, on the contrary im going above the call of the assignment.
i just want to clarify, you aren't answering the assignment for me, at all, as i still have to explain how i came to my conclusion and from where. I am merely staying within the theme of the course and using the help of others to navigate the project, something fully embraced by the past projects and even encouraged. A student received commendation for having emailed a friend when stuck on what was the reason for using a software block writer and not a hardware, he did what he needed to solve the mach investigation.
If i were to frame the question in a different way would you have been more willing to help? Lets say i accidentally formatted my USB with some of my important files on it, and now i cannot find them after using Recuva to the fullest of my knowledge. Would you be able guide me in the direction of retrieving formatted files?
I fully expect to sit back and mull on why i think i couldn't access them, but only after i have exhausted every resource first
Well, I knew absolutely nothing about you or your project except that the task did seem rather basic for a forensics course, but now we know that it isn't a technical course. However your question (if I absolutely knew the answer, which I don't) does have a technical explanation. Perhaps your professor simply wants 'Deleted files can't be recovered from a flash drive after it has been formatted', which is generally true more often than not. It's generally true because the formatting overwrites the file directories on the flash drive, which again might be what your prof wants.
It's not for me to tell you what you should know but I don't know how you would use the above information, as any tech savvy person would run rings around such generalities. It's probably fine for general computer knowledge but I don't think it's forensics. The reasons why you are having difficulties recovering the file depend on the file system type, the level of format, what happens during a format, the flash controller etc, even how long the flash drive has been plugged into the pc and receiving power, and some of that is highly complex (and beyond me).
I didn't intend to imply that you were lazy - or cheating. It's always better to think things through. I spend many an hour sitting in my chair with my eyes closed. There's lots of info on this forum about recovering from flash drives - or attempting to - so you could plough through some of that as well.