UPDATED with story: help with data recovery/FBI investigation

Ok heres the deal, I work for a newspaper, I do the website.
Theres a local ongoing story about the FBI investigating the IT department of the local school district.
They siezed 17 computers about 1 month ago.

Most people are unaware of the type of information that can be pulled from a computer, so the news department invited a local computer geek who has helped local police with this type of stuff to do a demonstration for the news department.
The news department grabbed an older non-used computer for this guy to use.

Heres where I need your help. This dude backed out and somehow I got conned into seeing what can be retrieved from this computer. Next monday, I have 1 hour to do whatever I want to this computer.
I can do the basics, like retrieving files that were deleted by not "over-written" yet...but what else is there?

What can I do to this old computer? What info can i get off of it?

Any help would be greatly appreciated.

UPDATE
well I spent an hour on friday with an old pc.
the story ran today - http://www.rrstar.com/localnews/your_community/rockford/20031229-4783.shtml

The reporter was most interested in the temp internet files, even though I told her that the temp internet files were basic and alot of people know to delete them.
In the hours time I had no luck in restoring deleted files.....if i would have spent more time i'm sure i could have retrieved stuff, but this PC was slower than molasses in january.
Seriously, it took 10 minutes just to boot the freaking thing, and another 8 minutes just opening the temp internet files.

 

[Soybomb]

Wouldn't calling a data recovery place and getting a few lines from an expert be a much nicer addition to the story? I just don't see the point of this exercise.

 

[mugs]

Originally posted by: Soybomb
Wouldn't calling a data recovery place and getting a few lines from an expert be a much nicer addition to the story? I just don't see the point of this exercise.

 

[OulOat]

Sounds as suspicious as the "hey, my sister changed my password and now I can't even get into my own computer."

 

[PowerMacG5]

Originally posted by: OulOat
Sounds as suspicious as the "hey, my sister changed my password and now I can't even get into my own computer."

I tend to agree.

 

[bonk102]

wow, this is a new way to ask for how to hack a computer

I need help with this "old" computer, yeah, ok

 

They've called multiple local places, none are willing to provide a demonstration. (at least for free)

 

[TommyVercetti]

How did you get conned into doing this?

 

Ok naysayers
http://www.rrstar.com/localnews/your_community/rockford/20031204-5713.shtml
http://www.rrstar.com/localnews/your_community/rockford/20031121-3558.shtml
http://www.rrstar.com/localnews/your_community/rockford/20031119-3213.shtml
http://www.rrstar.com/localnews/your_community/rockford/20031123-3807.shtml

and this is me
http://cf.rrstar.com/stafflist/showprof.cfm?department=Online&id=46

 

Originally posted by: TommyVercetti
How did you get conned into doing this?

When the FBI first seized the computers, the two school IT guys' websites vanished.
I was able to retrieve all of the info off their sites, as well as find sites/companies affiliated with their side business.
I matched some of the side business IPs with the IPs of the school districts WAN, the news dept was impressed, they think I can do everything.

 

[DAM]

wait wtf are you asking?

Are you asking what can you pull from these machines?

Check history of IE and see what sites they visited. Check to see if there are any saved passwords, cookies. Check for any files hidden. check for any strange file extensions.

 

[ReiAyanami]

uhh if the FBI is on it, don't they have their own guys that can do this? like the labs at Quantico

 

I'm asking what can i do to this box, as well as what could the FBI or data recovery people do.

The demonstration computer won't have anything worthwhile on it, is there anything better to do than just run one of those softwares that retrieve deleted files?

 

[ReiAyanami]

somehow, its all an RIAA crackdown on schoolchildren after losing the verdict to verizon...

 

Originally posted by: ReiAyanami
uhh if the FBI is on it, don't they have their own guys that can do this? like the labs at Quantico

Yeah...maybe I mis-worded......the news dept wants me to "do FBI type stuff" to one of their (the news dept's) old computers.

 

[OulOat]

First specify what you will be working on. Old computer is a very broad term.

 

[LikeLinus]

Originally posted by: jntdesign

Originally posted by: ReiAyanami
uhh if the FBI is on it, don't they have their own guys that can do this? like the labs at Quantico

Yeah...maybe I mis-worded......the news dept wants me to "do FBI type stuff" to one of their (the news dept's) old computers.

He;s doing a story and they are setting up a test to try and show "Joe Public" what exactly a person can retrieve off a computer no matter what has been deleted. He's looking for some sort of software tool to extra data that has been deleted and/or formatted over.

You wont find anything like that on the open market that is the level of what the FBI uses. You'll find tools that are able to retrieve "some" files after a format, but if anyone was trying to hide anything worthwile, you wont find it with those tools.

 

[ReiAyanami]

there's only a few dozen software programs that can recover deleted files:

http://download.com.com/3120-20-0.html?qt=file+recovery&tg=dl-2001

i'm sure u can try it on ur own comp before messin' with the demo, although i would imagine any disk recovery firm would be jumping at an opportunity to get free advertising by appearing on TV wearing a company logo t-shirt and hat...

 

I'm not really sure.
It will most likely be an <200mhz PC (considering it's old and unused, and theres still some people with 300mhz machines)

 

Originally posted by: ReiAyanami
there's only a few dozen software programs that can recover deleted files:

http://download.com.com/3120-20-0.html?qt=file+recovery&tg=dl-2001

i'm sure u can try it on ur own comp before messin' with the demo, although i would imagine any disk recovery firm would be jumping at an opportunity to get free advertising by appearing on TV wearing a company logo t-shirt and hat...

Thank you.

I live in Rockford, and theres not really an data recovery firms here...it's a pretty low tech city unfortunately.

 

[rutchtkim]

law enforcement uses a software called "Encase" to do a full forensics on a pc. look around for it, might be costly though...i dunno

 

[TommyVercetti]

Originally posted by: rutchtkim
law enforcement uses a software called "Encase" to do a full forensics on a pc. look around for it, might be costly though...i dunno

http://www.worldnet-news.com/encase.htm

 

Originally posted by: TommyVercetti

Originally posted by: rutchtkim
law enforcement uses a software called "Encase" to do a full forensics on a pc. look around for it, might be costly though...i dunno

http://www.worldnet-news.com/encase.htm

Awesome, thanks...both of you!

 

[OulOat]

They also can get the data off manually, even from dead HDs that has been formatted. That is why government entry level formatting does it 7 times (forgot the source).

Look at all the trouble the Department of Defense goes through to wipe data, shows that for any normal Joe their data can be easily compromised.

 

[TheBoyBlunder]

Originally posted by: jntdesign
I'm asking what can i do to this box, as well as what could the FBI or data recovery people do.

The demonstration computer won't have anything worthwhile on it, is there anything better to do than just run one of those softwares that retrieve deleted files?

In one hour? I doubt it. Just find data recovery program reviews, buy a copy of the overal best program, and charge it as an "expense related to the story". Then let the program work its magic.