Even if the search does not require covert access, there might be cases in which the basic techniques described in the preceding chapter might not be feasible. For example, the machine in question might have had a hardware failure, or it might have some nonstandard storage configuration that prevents a direct disk-to-disk copy.
Occasionally, an investigator might be asked to recover data from damaged media. The media might be physically damaged (either intentionally or unintentionally) or might have suffered some logical damage such as the deletion of files or a reformat. Most of the forensics tools discussed in the preceding chapter offer the capability to recover deleted files and data from file slack. ...