Computer and Hard Drive Forensics

What the drive kept that the user never saw

The desktop shows the files. The drive holds the rest: operating system records, application histories, storage metadata and available traces of devices that were connected. Read properly, those records explain when a file appeared, how it was used, whether it moved and what happened around the time it was deleted. Computer and hard drive forensics at GDF is the discipline of reading them properly and turning the result into findings your team can rely on.

Typical matters: a disputed file transfer, suspected wiping ahead of a litigation hold, a chronology that has to be pinned down, or a forensic image produced by the other side that needs an independent look. We start with the condition of the source and the question, then decide how to collect and what to analyze.

Pick the acquisition before you pick the search

A physical image copies the full storage address space the source exposes to the acquisition method. A logical collection gathers selected files or structures through the file system. A targeted collection narrows to defined sources or categories. Each is right for some matters and wrong for others, and in hard drive forensics the wrong choice at the start can leave gaps that cannot be filled if the source later changes.

Encryption, a live system, cloud-synchronized folders and failing hardware all shape the decision. A mounted encrypted volume on a running machine may give access that an offline image never will. A cloud placeholder file has a name and a date but no content, because the content lives on a server. We record each of these conditions so nobody later misreads what the collected material contains.

Where feasible we use hardware write blockers and work from verified copies. When a live collection is unavoidable, the changes it causes are documented rather than ignored. Hash values verify that the copy matches what we collected. They do not prove the original content was truthful, and they do not prove we collected every relevant source. Anyone who tells you otherwise is overselling the hash.

Spinning disks and SSDs forget differently

Volatile state and storage behavior can make prompt preservation important. Retention varies by source, power state and activity; no fixed elapsed-time cutoff or guaranteed recovery follows from that urgency.

Storage arrays, virtual disks, backups and snapshots frequently hold what the primary device lost. A nightly backup may preserve the state before the deletion. A virtual disk may be meaningless without its chain of snapshot files. The acquisition plan maps the whole source relationship, so a snapshot is not left behind on a hypervisor nobody thought to ask about.

Reconstructing activity, with corroboration

A Windows shortcut can record a relationship to a file, but does not by itself prove a person opened it. The NTFS change journal records changes such as creation, modification and deletion, not every read or user action. Browser history, application logs and sync client records fill in other parts. We line the artifacts up, normalize the timestamps carefully and keep the original time context where it changes the meaning.

Then we test the story against the evidence. A USB connection at a particular time does not prove a particular document was copied to it. A modification date does not prove who did the modifying. GDF builds conclusions from the combined record and writes down the competing explanations we considered. When another expert examines the same drive, that care is what keeps our findings standing.

Discuss the device with GDF

Talk with GDF before the device or storage evidence changes. Tell us the computer or storage type, its current condition, what has already been done to it and the question you need answered. We can plan secure handling, forensic collection, analysis, reporting and expert support. Your initial consultation is free.

Discuss the device with GDF

Related services and resources: computer forensics, data recovery, computer forensics expert witness, email Microsoft 365 forensics.