Understanding Memory in Computing part 1.pptx
- 1. Understanding Memory in Computing Pravash Chandra Das Digital Forensic Specialist
- 2. Disclaimer : This tutorial is for educational purposes only, showcasing digital forensics principles. Ensure legal compliance, ethical use and obtain proper authorization before applying these techniques. The creator is not responsible for any misuse or legal consequences resulting from the information provided. Always handle digital evidence with care to prevent data loss.
- 3. Introduction Memory in the context of computing generally refers to storage, where data and programs are stored for the computer to access.
- 4. Types of Memory There are different types of memory in a computer system. RAM, or Random Access Memory, is volatile and temporary. On the other hand, storage devices like hard drives and solid-state drives are non-volatile and retain data even when the power is off.
- 5. File Deletion When you delete a file from storage, it is not immediately erased. Instead, the operating system marks the space occupied by the file as 'available' or 'free,' allowing it to be overwritten by new data.
- 6. Recovery Tools Until that space is overwritten, the original data may still be recoverable using specialized tools. Forensic tools like Foremost and Autopsy are designed for this purpose.
- 7. How Recovery Tools Work ? These tools operate by scanning the storage medium for data that is not associated with any file or directory entry. They can identify and reconstruct data based on patterns and structures, even if the file system has removed the reference to that data.
- 8. File Recovery Process • Let's break down how file recovery works: • - Deletion: When you delete a file, the OS marks the space as available for new data. • - File Recovery Tools: Tools like Foremost and Autopsy search for data not linked to any file system entries. • - Data Reconstruction: The tools identify patterns and structures in the data. • - Overwriting Risk: If the space is overwritten by new data, recovery becomes challenging.
- 9. Factors Affecting Recovery The effectiveness of file recovery depends on factors like how much new data has been written to the storage device since the file was deleted.
- 10. Enhancing Data Security To enhance data security, consider using secure deletion methods or encryption tools when disposing of sensitive information permanently. Some file systems may also have features like 'trim' or 'secure erase' to help securely delete data.
- 11. Conclusion In conclusion, understanding how memory works and the risks associated with file deletion is crucial for maintaining data security in computing