Data recovery
After a successful preservation of digital evidence we normally recover data that has accidentally or deliberately been deleted. Oftentimes we can recover data has has been deleted a long time ago and that might even have survived a re-formatting of the disk. After the recovery a computer forensic analysis will be conducted.
For the recovery of digital evidence we use approved forensic tools and methods to recover deleted files and data fragments. With these forensic tools we can recover data that normal "unerase" tools can not recover (e.g. using techniques like "File Carving" or other means of low level extraction). We can also do complex data recoveries like raid reconstruction.
All the recovered digital evidence is then used for the computer forensic analysis and the following review in the investigation.