My cat has a better chance of "hacking" up a hair ball than a school IT department hacking a forum!

“Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.”

Computer forensics is a scientific approach to collecting, processing, preserving, and presenting electronic evidence. Failure to follow standard practices can make some or all evidence collected inadmissible in court. In this series of posts, I'll look at how to properly collect, process, and preserve evidence from both electronic and traditional sources. The discussion will be restricted to search and seizure practices in an office environment.