Recuva is a useful program

Recuva is a useful program that will scan the empty memory space on your computer to see if there are any files that can be recovered. Most users errantly believe that data is gone forever when they empty it from the Recycle Bin. This is incorrect. It merely marks the space as open to be written over if another file needs to be stored. Your operating system writes over these open spaces and subsequently “damages” the previously deleted file. From the Maryville Virtual Applications environment, Connect to the GUI of the Cyber Tools VM Type and select Recuva from the "Search Windows” bar. If prompted to install a new version, select No. From the Recuva Wizard, select Next. For the File Type, select All Files, select Next. Select the drive from which you want to recover files, select Next. Click Start. (The scan will take about 5 minutes since it is looking everywhere. You can reduce scan time by selecting a specific location in Step #4). After the scan completes, click on any of the recovered files listed that you find interesting (Click OK on the A: drive access error as this is not pertinent). Take a screenshot. Recover any file and save it to your desktop. Take a screenshot of the recovered file on your desktop. Students should then complete a page summary of their findings and discuss the differences between a forensic disk image and a regular disk image specifically discussing free and slack space implications. Also, discuss how forensic recovery can be used to help with corporate or law enforcement investigations. This page should be at the beginning of your lab.