According to a December 9th article on the Allgov.com website, British Petroleum has accused contractor Halliburton of intentionally deleting structural test results that could shed light on the fatal oil well blowout of April 2010. The stability test results, shown in 3D modeling cement tests, could point to ignored potential failure. BP has requested that the computer used in the tests be released to a forensic data recovery company for analysis.
Forensic hard drive recovery is more involved than normal recovery of lost data. The data on this type of drive has not necessarily been accidentally deleted; it may have been an intentional act. Because forensic recovery will be used for legal purposes, extreme care must be taken to ensure that data is not corrupted further. Additionally, the recovery engineer may not be looking for specific files as much as reconstructing fragmented data and looking for specific information. The engineer will need to access areas of the drive that are not normally used in recovery.
The drive may also have been protected by safety measures to prevent recovery for legal investigations. Often the recovery engineer must make copies of the drive, working on them instead of the original drive. This will preserve the original evidence for use in legal proceedings. Forensic data recovery requires expertise and training above that which is used in normal data recovery.
The Data Rescue Center, a California data recovery service company, has provided forensic services for law enforcement agencies and government agencies in legal cases. The founders of its parent company, Prosoft Engineering, have been developing recovery software since 1985. It has been used by law enforcement and all of the major U.S. military branches, as well as major intelligence agencies.