💾Deleted computer data
#notes
What happens when a file is deleted?
For an investigator analyzing a suspect's computer, there is always data of particular interest.
It is very simple: the file system changes one attribute for it and thus it is marked as deleted. The content of the file still remains on the hard disk and can be recovered using one of the many free and paid programs (e.g. R-Studio or Recuva).
Even when using recovery technologies that read data directly from magnetic media, it would be impossible to recover deleted files.
But there are still loopholes for extraction of information!
#notes
What happens when a file is deleted?
For an investigator analyzing a suspect's computer, there is always data of particular interest.
It is very simple: the file system changes one attribute for it and thus it is marked as deleted. The content of the file still remains on the hard disk and can be recovered using one of the many free and paid programs (e.g. R-Studio or Recuva).
Even when using recovery technologies that read data directly from magnetic media, it would be impossible to recover deleted files.
But there are still loopholes for extraction of information!