Results 1 to 9 of 9
  1. #1
    Member
    Join Date
    Feb 2006
    Posts
    2
    Points
    0

    Default Analyizing data on hard drive

    If a computer is taken and has the data on the hard drive analyized, will it show emails sent/received in hotmail or yahoo that have been deleted? Also, if you typed something under microsoft word, but did not save it to a file, then erased it, would it show up on the hard drive? Thank you.

  2. #2
    Member Help2Go Moderator
    Join Date
    May 2003
    Location
    Boston, MA USA
    Posts
    2,994
    Points
    931

    Default

    Simple answer: yes

    I'm sure other suggestions will come giving a more detailed explanation, sorry, I'm tired

    Partieā„¢

  3. #3
    Member galena1's Avatar
    Join Date
    Oct 2003
    Location
    Devon -UK
    Posts
    3,109
    Points
    429

    Default

    Hi pam - This should help clarify things for you.
    A common misconception when deleting files is that they are completely removed from the hard drive. However, users should be aware that highly sensitive data can still be retrieved from a hard drive even after the files have been deleted because the data is not really gone. Files that are moved to the recycle bin (on PCs) or the trash can (on Macs) stay in those folders until the user empties the recycle bin or trash can. Once they have been deleted from those folders, they are still located in the hard drive and can be retrieved with the right software.
    Any time that a file is deleted from a hard drive, it is not erased. What is erased is the bit of information that points to the location of the file on the hard drive. The operating system uses these pointers to build the directory tree structure (the file allocation table), which consists of the pointers for every other file on the hard drive. When the pointer is erased, the file essentially becomes invisible to the operating system. The file still exists; the operating system just doesn't know how to find it. It is, however, relatively easy to retrieve deleted files with the right software.

    The only way to completely erase a file with no trace is to overwrite the data. The operating system will eventually overwrite files that have no pointers in the directory tree structure, so the longer an unpointed file remains in the hard drive the greater the probability that it has been overwritten. There are also many "file erasing" software products currently on the market that will automatically permanently erase files by overwriting them.

    Regards.
    I know everything about nothing, nothing about everything and precious little about the bit in between.
    P4-3.0G - Seagate Barracuda 160 - Maxtor 120 - Antec Hard Drive Cooler - 1GRam - Radeon9800Pro - Sony Multi DriveDVDRW - Audigy2 6.1 - XPHome

  4. #4
    Member Shinobi's Avatar
    Join Date
    Sep 2003
    Location
    UK
    Posts
    873
    Points
    314

    Default

    It depends on various factors.

    Hotmail/Yahoo email accounts are web based. I don't use these much so I am not 100% sure if messages are (or can be) stored on your hard drive, or more likely on the yahoo/hotmail servers remotely. However there may be copies of messages you have viewed residing in temp files on your hard drive. If they have been deleted from the remote servers then it would be hard to retrieve them. This would really depend on the retention & privacy policies of yahoo/hotmail and who was asking to retrieve the data. A law enforcement agency for example may be able to get a court order if the circumstances justified it.

    As for the word document, I am not so sure what you mean....a document was witten but never saved or saved then deleted? If it was saved at all then there is a chance to retrieve it. It would depend if the OS had overwritten it or not. The more free space you have on your hard drive the more chance there is to retrieve it. Even when the OS has overwritten files there can still be a chance to partly reconstruct the files if you know what you are doing. The explainations for this sort of thing can become very complicated and there are just too many variables involved to give you a simple yes or no answer.

    However in very general terms I would say if data has not been securley erased (overwritten) from your hard drive by using an appropriate tool then chances are at least some of the data can be retrieved.

  5. #5
    Member
    Join Date
    Feb 2006
    Posts
    2
    Points
    0

    Default Better explanation

    What I meant with typing in microsoft word was: if you typed a letter, but then did not save it to a file at all, then used your curser to erase the whole thing, would this still show up on your hard drive? If it has been 9 months or longer, would a computer overwrite something or how long does that typically take. Thanks, Pam

  6. #6
    Member Shinobi's Avatar
    Join Date
    Sep 2003
    Location
    UK
    Posts
    873
    Points
    314

    Default

    If you did not click on the save icon or use any of the save commands from the file menue then I doubt it ever got comitted to your hard drive. I would suspect that when you are typing away in word that everything is stored in RAM memory until such time as you use the save command. Anything stored in RAM dissapears when the power is switched off.

    Please note though I am only guessing here as I know nothing of the internal workings of Word.

  7. #7
    Member texsized's Avatar
    Join Date
    Sep 2005
    Location
    Lone Star State!
    Posts
    233
    Points
    7

    Default

    i don't use much of word anymore but if my memory serves me well it has a timed saving function that saves the most recent copy at the timed capture point. it is immaterial whether or not you had saved the file the first time. therefore i think the file being typed (tho' not saved with a file name as yet) could possibly be resident on a temporary location somewhere on the hdd.
    we are created with an equal opportunity to be unequal.

  8. #8
    Administrator Help2Go Administrator Canuck's Avatar
    Join Date
    May 2003
    Location
    Edmonton, Alberta, Canada
    Posts
    9,817
    Points
    2034

    Default

    I think the default location for autobackup is C:\Documents and Settings\yourname\Application Data\Microsoft\Word if not there, go one more step to Startup. Hope this works for you.


  9. #9
    Member galena1's Avatar
    Join Date
    Oct 2003
    Location
    Devon -UK
    Posts
    3,109
    Points
    429

    Default

    Hi pam - I believe Tex is right here. This extract from Post#3 above
    "What is erased is the bit of information that points to the location of the file on the hard drive" would imply to me that the information is retained on the hard drive but until you Save it there is no reference to point you to where it is.
    To switch off auto save in Word -
    Open a new blank Word document and go to 'Tools' on the top toolbar.
    Click 'Options'>'Save' tab. Just below half-way is a heading 'Save Auto Recover Every:' To the left of this heading is a check box. If it is checked then 'Autosave' is enabled. Uncheck the box to disable Autosave. To the right of the heading is a small window where you can change the frequency/timing of autosave.
    I think that after 9 months it is very likely that at least some of the data will have been overwritten. The only way that you could be entirely sure of what is, or isn't, on the hard drive would be the use of specialist recovery software/services to extract the data, but even this wouldn't guarantee recovery. You should remember that even with Autosave disabled, the data will still be somewhere on your hard drive.
    Regards.
    I know everything about nothing, nothing about everything and precious little about the bit in between.
    P4-3.0G - Seagate Barracuda 160 - Maxtor 120 - Antec Hard Drive Cooler - 1GRam - Radeon9800Pro - Sony Multi DriveDVDRW - Audigy2 6.1 - XPHome