The Enron Scandal (2001) — File Carving & Data Recovery

Enron executives tried to destroy emails and spreadsheets by pressing 'Delete' and reformatting drives. Investigators used file carving tools to scan raw disks for file headers.

## Background

Enron executives tried to destroy emails and spreadsheets by pressing 'Delete' and reformatting drives. Investigators used file carving tools to scan raw disks for file headers.

## Learning Objective
Recover deleted files using file headers/footers (JPEG, PDF, ZIP) even when the file system is corrupted or formatted.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: The Enron Scandal (2001) — File Carving & Data Recovery
- Year: 2001
- Domain: Cyber Forensics
- Difficulty: Expert

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-enron-scandal

## Investigation Questions

1. Why didn't deleting files and reformatting drives destroy the evidence?
2. How does file carving recover data without file system metadata?
3. What are JPEG and PDF file signatures and where are they defined?
4. Why is formatting a drive insufficient for secure data deletion?
5. What carving tools would you use to recover PST email files from raw disk?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
Formatting a drive does NOT erase data. Carving looks for patterns, not filenames. The data is always there until sectors are physically overwritten.

## Forensic Takeaway
Deleting a file just removes the pointer in the MFT. The actual data resides on disk until overwritten. Carving recovered the 'smoking gun' memos.