Obtaining Deleted Data

Posted in: Media

How can deleted data be obtained

When a file is deleted it isn’t really erased, it continues to exist on a hard drive, even after emptying it from the recycle bin, which allows recovery of deleted files.

A file recovery program can scan a hard drive for deleted files and restore them; however, if the file has been partially overwritten, the file recovery program will only recover part of the data.

Mobile devices contain deleted information even after an individual has attempted to delete its content, this is due to the device’s flash memory chip that stores and preserves the data making it difficult to destroy. In order to access and recover older/deleted copies of data, it is necessary to obtain a full copy of the physical memory.

Computers – deleting a file doesn’t actually delete the file’s data, just the record of where the file is located. The data remains even though the device marks that location as free. The only way to completely deleting a file is by overwriting it with a new file.

Ways to erase data

File shredding applications overwrite all the data making it unrecoverable. However, if there is a copy of the file and only the original file was deleted, this copy may still exists on the hard drive and can be recovered.

Disk-wiping programs will erases all data from the hard drive including the operating system and all personal files, overwriting them with useless data.

Master File Table (MFT) indicates to a computer a file and its location in order to find and recover deleted or lost files.

What can’t be obtained and why

Some apps may be built to be anti-forensic, for instance, Snapchat was developed to allow users to view an image for just a few seconds before deleting it, and therefore there is no data to recover.