Re: Hard Drive Forensics Question

["Razi Shaban" <razishaban () gmail com>]

> The only thing they could prove would be that he did copy the files, if he
> did, never deleted the files, and the area of the drive the files were
> written to had also never been written over in the six months since then.

Perhaps it would be a good idea to copy+paste+delete a few very large
random files on there (99.5% occupying the drive) a few times, just in
case. If he feels the random data files would appear suspicious, copy
the largest files on the drive a few times. This will help to make it
more difficult — if anything, quite difficult — to recover any data
that may have been on the hard drive.

You might also want to run a free data recovery program such as Recuva
(http://recuva.com) to see if it can find anything potentially
incriminating.


Hope it helps,
Razi Shaban