The Five Levels of Data Destruction: A Paradigm for Introducing Data Recovery in a Computer Science Course

Abstract

Digital forensics has become a fundamental piece of many cyber security programs across the US, and data recovery is an integral building block of digital forensics. Data recovery can be a difficult topic to cover without a system or organization to the different methods of recovery. The following manuscript offers a structure for introducing data recovery in a digital forensics or information technology course and a method for evaluating the admissibility of recovered files as court evidence based on how the data were recovered. This offers both a framework for teaching data recovery and a way for discussing evidence admissibility. The five levels of destruction paradigm is a result of over a decade of teaching digital forensics in vocational and academic environments in a computer science program. The authors offer up this paradigm in hopes it will be useful to other computer science and digital forensics educators.