Deleted Files
Tyeshia Smith
CJUS 363-D01
Liberty University
[Title Here, up to 12 Words, on One to Two Lines]
Digital evidence is any information that is stored or transmitted in the digital form that a
party at court can use at the time of trial. The attempts at erasing digital evidence is very
common in the criminal world. Digital evidence can always be recovered as long as the
forensics know what action was taken to destroy the evidence, how long ago the evidence was
deleted and what type of storage device like a magnetic hard drive, flash memory or SSD card
was used.
Digital evidence can be audio files, voice recordings, address books and contact lists, backups to
various program including backups to mobile devices, browser history, cookies, database,
compressed archives (Zip, RAR, etc) including encrypted archives (Computer Forensic
Resources, 2021).
Accidental file deletion can almost always be recovered because files are never
permanently deleted. Even in efforts of trying to destroy the data storage device, data can almost
always be recovered. All data might not be recovered but a substantial amount can help any
case. Accidentally deleting a file is very common and when backups don’t exist there are tools to
recovering the files deleted. At times deleted files are not accidental and at times additional
efforts are taken to completely scrub the storage device like reformatting a hard drive, or
rewriting new data over the old data multiple times. Deleting files is one of the easiest ways to
destroy evidence, whether it’s using the “delete” or “shift +delete” buttons. Windows does not
necessarily deletes the file. Instead, a file system record storing the exact location of the deleted
file (GeeksforGeeks). The file will present as available but it will not be overwritten with zeros
of other data. In data recovery the digital forensic technician must identify all the electronic
devices that could potentially contain evidence like servers, computers, external hard drives,
laptops, iPads, smartphones or USB memory devices. Most encrypted files can be decrypted and
the technician must be confidence in knowing that deleted files are recoverable. The technician
must have the proper tools and knowledge in how to extract data from electronic devices.
Steps
There are tools and steps needed to properly retrieve data that’s been accidentally deleted
and is not showing up in the recycle bin. If a file has been deleted and you already analyzed the
recycle bin for its contents and it’s not there you must use a commercial recovery tool like a
DiskInternals Partition Recovery. A DiskInternals Partition Recovery is an advanced software
tool that recovers lost data or lost partitions. If you accidentally erase a file you must not create,
add, delete, or copy the partition in the same drive. This will overwrite the old information with
new information and all your previous files might be deleted for good. DiskInternals Partition
Recovery works on different kinds of storage devices like HDD, SSD, flash drive, external hard
drive, memory cards, IDE disk, SATA disk, SCSI disk and plenty more. DiskInternals Partition
Recovery contains NTFS recovery and FAT recovery software that make data recovery faster
(DiskInternals, 2022).
To recover partitions using the DiskInternals Partition Recovery tool you first need to
download and run the trail version of the tool. The recovery tool should start automatically. Next
you should select the disk in physical drive and the disk recovery mode. To restore the partition
you will need to select full recovery mode then click next. Fourthly, scan and wait for the
process to be completed. Preview and recover the partition’s files. Recoverable files are usually
marked with a Red Cross in the upper left hand corner. Right click the file and select “preview
in new window” then you will be able to restore the files with one click of the recovery button.
Lastly, save it. Might have to purchase a license then enter the license key. No rescan or reinstall
is necessary. Select the location for the restored partition and click save (DiskInternals, 2022).
DiskInternals Partition Recovery is proven to be very efficient, effective and fastest way
to get your information back. The software is safe, easy to use and restores data from hard drive
disks and it’s partitions, no matter the file type or the reason for the loss.
References
https://www.diskinternals.com/partition-recovery/ Information commissioner’s opinion:
The use ... - ico.org.uk. (n.d.). Retrieved March 3, 2022, from
https://ico.org.uk/media/2619985/ico-opinion-the-use-of-lfr-in-public-places-
20210618.pdf
https://www.geeksforgeeks.org/recovering-deleted-digital-evidence/amp/
https://computerforensicsresources.com/service/data-recovery/
