Introduction
Many computer users assume that deleting a file permanently removes it from a computer, mobile phone, or storage device. In reality, deleting a file often only removes the reference to that file within the operating system, while the underlying data may remain intact on the storage media.
Digital forensic specialists use a variety of techniques and tools to recover deleted files for use in criminal investigations, civil litigation, corporate investigations, and family court proceedings.
This article explains how deleted files are recovered, the factors that affect successful recovery, and the role of digital forensic experts in the process.
What Happens When a File Is Deleted?
When a user deletes a file, the operating system typically does not immediately erase the file’s contents from the storage device. Instead, it marks the space occupied by the file as available for future use.
For example, in Windows systems, deleting a file usually removes its entry from the file system’s index. The actual data remains on the hard drive or solid-state drive until it is overwritten by new information.
As a result, deleted files may remain recoverable for days, weeks, months, or even years, depending on how the device has been used since deletion.
Understanding File Systems
Every storage device uses a file system to organise and locate data. Common file systems include:
- NTFS (Windows)
- FAT32 and exFAT (USB drives and memory cards)
- APFS (Apple devices)
- EXT4 (Linux systems)
When a file is deleted, information about the file may still exist within the file system. Digital forensic software can examine these structures to identify deleted files and reconstruct them.
Methods Used to Recover Deleted Files
File System Analysis
Digital forensic investigators first examine the file system metadata. This may reveal:
- Deleted file names
- File sizes
- Creation dates
- Modification dates
- User activity
Even if a file has been deleted, traces of its existence may remain within the file system records.
Recovery from Unallocated Space
Unallocated space refers to areas of storage that are not currently assigned to active files.
When a file is deleted, its contents often remain in unallocated space until overwritten. Forensic tools scan these areas to identify and recover file fragments.
File Carving
File carving is a forensic technique used when file system information is missing or damaged.
The process identifies files based on known file signatures and structures. For example:
- JPEG images contain identifiable headers and footers.
- PDF documents have specific file signatures.
- Microsoft Office files contain recognisable patterns.
By locating these signatures, investigators may reconstruct deleted files even when directory information no longer exists.
Recovery from Backups and Shadow Copies
Many operating systems automatically create backups or restore points.
Investigators may recover deleted files from:
- Windows Volume Shadow Copies
- Cloud storage backups
- System restore points
- External backup devices
- Enterprise backup systems
These sources often contain historical versions of files that have been deleted from the primary device.
Recovery from Mobile Devices
Mobile phones frequently store deleted data differently from computers.
Digital forensic tools can sometimes recover:
- Deleted text messages
- WhatsApp messages
- Photographs
- Videos
- Contacts
- Call logs
- Application data
The success of recovery depends on the device model, operating system version, encryption settings, and how much time has passed since deletion.
Factors Affecting Recovery Success
Overwriting
The most significant factor affecting recovery is overwriting.
Once new data occupies the same storage location as the deleted file, the original data may be partially or completely destroyed.
Solid-State Drives (SSDs)
Modern SSDs often use a feature known as TRIM.
TRIM helps improve performance by automatically clearing deleted data blocks. This can significantly reduce the likelihood of successful file recovery compared to traditional hard disk drives.
Encryption
Encrypted devices present additional challenges. Without the correct credentials or encryption keys, deleted data may be inaccessible even if recovered from the storage media.
Time Since Deletion
Generally, the sooner a forensic examination is conducted, the greater the likelihood of successful recovery.
Continued use of the device increases the risk of deleted data being overwritten.
Forensic Soundness and Evidence Preservation
In legal proceedings, it is essential that deleted file recovery is conducted using forensically sound methods.
Digital forensic experts typically:
- Create a forensic image of the device.
- Preserve the original evidence.
- Document every stage of the examination.
- Use validated forensic software.
- Maintain a clear chain of custody.
These procedures help ensure that recovered evidence can be relied upon in court.
Common Types of Recoverable Deleted Data
Digital forensic investigations frequently recover:
- Documents
- Emails
- Spreadsheets
- Images
- Videos
- Internet browsing history
- Chat messages
- Social media communications
- Financial records
- Business records
Even partial recoveries can provide valuable evidence in an investigation.
The Role of a Digital Forensic Expert
A digital forensic expert uses specialist tools and methodologies to identify, recover, analyse, and interpret deleted data.
Their responsibilities may include:
- Examining computers and mobile devices
- Recovering deleted files
- Producing expert witness reports
- Explaining technical findings to courts and solicitors
- Providing evidence in criminal, civil, and family court proceedings
The expert’s objective is not only to recover data but also to ensure that the recovery process can withstand legal scrutiny.
Conclusion
Deleting a file does not necessarily mean it has been permanently removed. In many cases, deleted data remains recoverable until it is overwritten or securely erased.
Through file system analysis, file carving, examination of unallocated space, and analysis of backups, digital forensic experts can often recover important evidence from computers, mobile phones, and other digital devices.
As digital evidence continues to play an increasingly important role in legal and corporate investigations, the ability to recover deleted files remains one of the most valuable capabilities within the field of digital forensics.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensic experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years. Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
