Chapter 29. Deleted Data
Information in this chapter:
• How data is stored on a hard drive
• Deleted file recovery
• Evidence of data destruction
One of the foundations of digital forensics is data recovery. Luckily for digital forensics examiners, truly deleting data on digital devices, especially computers, is quite hard to do. This chapter explains the ins and outs of what a computer does when it deletes data, and the different ways it does so. Usually in digital forensics, it is not a matter of whether data still exists or is really gone. The black and white are thin lines bordering the chasm of grey when it comes to deleted data. Usually it is just a matter of to what degree the data has actually been deleted. This chapter will explain the different ...
Get Digital Forensics for Legal Professionals now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
