Backup tapes provide an invaluable "snap-shot" of a data from a range of different times. On-line data is transient and open to manipulation, so email and other documents may have been removed before any attempt to perform a forensic examination of any systems could be made. Often attempts to hide incriminating evidence are made in panic, driven by a realisation that detection is imminent, but by then the data is already stored across several months of tape backups and can still be found.

For some companies the examination of data is based upon a suspicion that something is amiss within the operation. Having systems imaged for examination will cause unrest within an organisation and could cause unwarranted disruption. The tape backup archive can be examined with little or no impact upon an organisation, the tapes may even be housed off-site and so no-one need know that the work is being undertaken.

Attempts to prevent access to data for forensic examination can range from deletion of files, through the re-formatting of media and erasure of tapes, to the physical damage of disks and tapes. Altirium's data recovery services can be used to recover and secure data for forensic inspection even when data appears to have gone forever.