Help for a friend (data recovery)

[Enresshou]

Hey, all,

A friend's boss owns a veterinary clinic and recently fired a shifty worker. Before the worker left, she claimed she needed to take a few word documents from the computer; immediately after this, the drug log--something veterinarians are required to keep on-hand--was deleted, and the fired worker reported the veterinarian to the review board. The vet's a really nice woman, and I'd like to help her out; so do any of you know:

1) Is it possible to recover this drug log (potentially through a data recovery service?), and
2) Is it possible to get a 'time stamped' document showing that the log had been kept up-to-date until she was fired? The veterinarian would (understandably, in my opinion) like to press criminal charges if possible.

Thanks so much for all the help!

 

[Neon Pirate]

Best thing to do since the vet wants admissible evidence is go to a forensic specialist. You will be able to get the file an information on the deletion. I know a few so message me if the vet is serious about pursuing that path. Otherwise two of the better utilities for just getting the file back are FilerecoveryPro http://www.lc-tech.com/demo/frprodemo.html , Pareto's Data Recovery http://www.paretologic.com/products/datarecovery/pro/index.aspx , Easus has a great recovery tool http://download.cnet.com/Easeus-Dat...48_4-75184619.html?tag=rb_content;contentMain and VirtualLab Data Recovery http://download.cnet.com/VirtualLab...48_4-10610841.html?tag=rb_content;contentMain does a nice job.

 

[doomdragon6]

That sounds complicated.

I've actually done similar with random programs googled off the 'net. Go with whatever he said ^, but it is possible.

I had a program that got deleted files back from SD cards, which I figured wasn't possible at all.

 

[strawman]

Don't use the computer until you have someone image the hard drive, as a minimum. Anything you do now may result in making it impossible to recover the data.

While they may be able to do it themselves or with a regular person, I'd vote to take it to forensic specialist so you can create a paper trail that is somewhat more admissible in court than joe the corner computer expert would be.

Also, contact the company that made trhe software they use, if they use specialty vet software. Sometimes the programmers do a good job of creating an audit trail of users actions.

But the first thing to do is to stop using the computer until the drive is bit for bit imaged (ie, not just a file copy, but using a program such as Ghost or similar to get every bit of every partition). Using the computer can slowly overwrite previously deleted files.

Of course, they should have, at minimum, weekly backups - and if so it's not a big problem, since they can get the file back up to date using other records (receipts, appointments, etc). If not, maybe they should consider backup - especially off-site backup to prevent further employee malfeasance.

 

[Chibibar]

Image the computer ASAP. How was the file delete? normal delete? or with an actual software (3rd party) which "shread" the bits?

If it is normal deletion, it can be recovery pretty easily, but you want a full snapshot of the hdd before doing anything. Cause as you use the PC, the bit could be overridden and can't be recover.

 

[Enresshou]

Hey, everyone, thank you so much for the replies! I'll be contacting the veterinarian later on and letting her know about this.

Unfortunately, she just let me know about this but it happened a month ago or so. I'll forward her to this thread, and--if she's able to recover the data--I'd appreciate any help pursuing the legal path. Thanks again, everybody...this place has never let me down.