Files that have been deleted can also be reconstructed, either partially or completely. The Windows operating system will not delete files when the user selects deletion. The operating system will mark the space a deleted file takes up in the Master File Table as available to write new files to. As a result, analysts may be able to view deleted files that have not been overwritten.
One challenge that is facing forensic analysts is the use of Solid State Drives (SSDs) in tablets and computers.Deleted files can often be recoverable from traditional platter hard drives even after a system is powered down.With SSDs, the operating system will often remove deleted files to make the storage of files more efficient.For more information ...
