Why overwritten data cannot be recovered...

Magnetic media is composed of small weak domains in which all of the magnetic moments are aligned in one direction. A domain acts a weak magnet aligned in some random direction. Consider the surface of a disk drive upon which information has not yet been recorded. As the drives magnetic head passes over the medium, the domains align underneath its surface.

The area located a short distance away from the head generation the field is referred to as the fringe area. Although the magnetic field is weaker in the fringe area, it is strong enough to convert a smaller weaker domain into one that is strong. When the head passes over the media a second time, the magnetic field produced underneath the head is strong enough to change the domains orientation. However, the field generated in the fringe areas does not possess the strength to alter the fringe domains.

Thus in an ideal case, the original information remains in the fringe area. The domains of the fringe areas are translated to bits, which are in turn assembled to form data elements. It is not necessary to observe the magnetic domains directly. The most straightforward method is to align a modified head and circuitry in order to track a fringe area and read the information in the normal fashion. Domain condition may be ascertained by the strength and form of the signal.

The existing automated forensic tools play vital role in the aspect of recovery. Each forensic tool has its own limitations and constraints. The existing tools show little effort to recover the file when the disk is magnetically altered and/or physically damaged and/or overwritten, by the experienced culprits. Hence there is an urgent need to enhance the automated tools with the above-discussed techniques to make the computer forensic analysis a full pledged and legally valid.