Anyone know a computer forensics person to asks if someone wipes important info. off the internet

[midnight]

history how it can be retrieved... Thanks for any suggestions of help in this matter....

[TroglodyteScholar]

1. Need...more...input...

[midnight]

3. I need to recover the search history of a work computer... I have been told it is wiped clean

every twenty days and no longer exists.... However years ago, it was discussed that once a search is made that history lasts.... I'm wondering if search histories are not really lost or removed but retrieved via another method not made available for some other reasons?

[TroglodyteScholar]

5. Read up on the index.dat file

You might want to see if the index.dat file was left intact. Read here:

https://en.wikipedia.org/wiki/Index.dat

This tool may be helpful if you don't mind going into world of the command prompt...

http://www.tzworks.net/prototype_page.php?proto_id=6

[midnight]

6. Thanks for the two links...

[RoccoR5955]

2. From the limited amount of information you give

The only way would be a bit by bit scan of the computer.
You should remember that files are not really deleted on a computer, until the storage (aka hard drive) is out of room. They are then overwritten.
Typically, when you delete a file, the file is marked as deleted, and eligible to be overwritten, if needed, on that part of the storage.
There is software that can read the raw data on a storage device, and this is what is necessary if one is to read a file that is "deleted."

[midnight]

4. Do you know the name of a software that could make available a search history on a particular

computer a company is claiming was removed via their twenty day policy? Thanks...

[RoccoR5955]

7. I don't know that, but

There is a piece of software called "Disk Investigator," which will allow you to do a sector by sector read of the hard drive.
It is a very painstaking task to find data, if you don't know EXACTLY what you are looking for. You can page through the millions, even billions of bytes on the HDD to see the data, but it will take a LONG time.
http://www.theabsolute.net/sware/dskinv.html
There's a link in case you are curious.
I do not know the method that such a software company can use, but they may replace the data with zeros and ones, if they truly seek to remove all traces of the data.

[midnight]

8. I only know the a specific time period... Would that cut down on the time? Thank you for your

info..

[RoccoR5955]

9. Not at all

What would help, would be the specific areas of the disk, or using the search function, if one is built in, some word that is unique to the files, but I am guessing.