There are three common scenarios in which you may want to recover deleted images:
- Images accessed from web sites
- Images downloaded by a user or obtained through file sharing applications
- Photos stored on a computer hard drive, camera or memory card
During a computer forensic investigation, it is common to recover tens of thousands of images from a user’s hard drive. The majority of the images will be irrelevant, because they include icons, application images, toolbar pictures, advertisements from web pages, and windows default pictures. Images on web pages visited are cached (automatically downloaded) to a computer, then cleared or purged after a period of time or by the user who chooses to clear them. Images and web content are automatically cached so that the web page will load faster the next time a user visits the website. This information can be recovered and used to recreate web mail (Yahoo, Gmail, Hotmail, etc.) and pages visited.
Valuable artifacts may be included in the large collection of irrelevant images related to the websites that a user visited and images or pictures that were downloaded. Computer forensic examiners employ powerful recovery tools that can restore images from a variety of media.