Criminal Forensics

bobland said:

No one has answered my question. Where are search data strings stored?

I myself can't answer that question. Also be aware that those "search data strings" may be something unique to law enforcement..... And something not publically published for obvious reasons

Bare Foot Kid said:

Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.

He clearly understands that - that's why he's asking about the technology law enforcement uses to recover it. Curiosity???

If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.

I would imagine that police forensics use the latest data recovery technology so one could never be sure the data is not recoverable.

The full combination of disk wiping regimens including DOD standard are available on the Disk tab of free Partition Wizard boot CD.

The average person whose computer has been confiscated by law enforcement has not even attempted a format to erase anything.

Formatting is not the point of the OP's post.

Does law enforcement look in particular folders on the hard drive for search strings? If so, what folders?

Or, alternatively, does law enforcement just capture the computer's IP address and then contact the ISP in question and/or Google to find out what search terms may have been entered into Google from that IP address?

The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where, and can that location be cleared? If cleared, can that cleared space then be wiped (overwritten deliberately)?

From reading this thread, I don't see any answers on the point.

I periodically see apps designed to wipe ONLY unoccupied space--I think CCleaner has such a capability. But I have no idea how well it works.

gregrocker said:

If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.

Not to be paranoid but I've been saying this for a while now. Google is becoming the premier information corporation worldwide. Information is power. Who controls it???

Anyway there are tons of ways for law enforcement to recover data you've created or searched for. Don't want them to find it.... don't use the internet, or computers

ignatzatsonic said:

The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where?

From reading this thread, I don't see any answers on the point.

I don't think there is a simple answer, and certainly not one non-forensics people can answer.

Bare Foot Kid said:

Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.

I'm not certain that it is as thorough as other options, but a low level format does delete data. If course, that only works on a drive or partition, not specific data within them.

severedsolo said:

This may be of interest: HowStuffWorks "How Computer Forensics Works" I've only given it a skim read, but it looks interesting, will have a proper look later.

I read through the above link and found nothing particularly revealing, other than the following quote, which implies data can be recovered from RAM, even after a shutdown. Not surprising, I guess.

"There are several programs designed to preserve the information in a computer's random access memory (RAM). Unlike information on a hard drive, the data in RAM ceases to exist once someone shuts off the computer. Without the right software, this information could be lost easily."


But I found nothing in the article regarding folders, locations, wiping, overwriting, etc. It does give a brief background on anti-forensics.