When a file is deleted, in most cases its content is not destroyed immediately. The system simply marks the space as free and removes the reference from the list of files. Until that space is reused, the data physically remains on the medium. The recovery techniques used in digital forensics are based on this principle.
What really happens when you delete a file
A file system works rather like a book's index: it keeps track of where each file is on the disk. When you delete a file, usually:
- the file's entry in the index is marked as deleted;
- the disk areas it occupied are declared available;
- the actual content stays where it is until new data overwrites it.
Emptying the Recycle Bin does not change the substance: it is another logical deletion, not a physical destruction of the data. Even a quick format of a drive, in many cases, only recreates the file system structures and leaves much of the previous content intact.
Two recovery techniques
Recovery through the file system
If the file's entry in the index still exists, even if marked as deleted, its name, dates, size and data location can be found. Recovery in this case is often complete and keeps the original metadata. It works well for recently deleted files, before the system reuses those entries.
File carving
When the file system information is gone, you can search the raw data on the drive directly. Many file formats begin, and sometimes end, with characteristic byte sequences called signatures. A JPEG image, a PDF document and a ZIP archive have recognisable headers.
File carving scans the whole medium looking for these signatures and extracts the data that follows. It has limits, though:
- original names and dates are lost: recovered files get generic names;
- fragmented files are hard to rebuild, because their parts are not contiguous;
- there are many false positives, fragments that look like files but are incomplete or corrupted.
| Aspect | File system recovery | File carving |
|---|---|---|
| File name | Often preserved | Lost |
| Original dates | Often preserved | Lost |
| Fragmented files | Recoverable | Difficult |
| Works without the index | No | Yes |
When data cannot be recovered
There are situations where recovery becomes unlikely or impossible.
Overwriting
If new data has taken the place of the deleted file, the original content is lost. That is why, when deletion is suspected, the first rule is to stop using the medium: every new save, update or installation reduces the chances.
SSDs and TRIM
On solid-state drives, the operating system tells the drive which blocks are no longer in use through the TRIM command. The drive's controller can then wipe them on its own, sometimes within minutes. On a modern SSD with TRIM enabled, recovering files deleted some time ago is often impossible. On USB sticks and memory cards, behaviour varies greatly from device to device.
Encryption
On an encrypted volume, data recovered from free space is encrypted too and unusable without the key. If the volume is acquired while already unlocked, recovery proceeds normally.
Secure deletion
Dedicated programs deliberately overwrite file content before deleting it. In these cases the content is lost, but traces of the program's use often remain, and that can be a relevant finding in itself.
Alternative sources
When a file cannot be recovered from the drive, it may exist elsewhere:
- volume shadow copies and restore points;
- local and cloud backups;
- temporary folders and programs' autosave files;
- thumbnails and previews generated by the system;
- attachments of sent or received emails;
- copies on other synchronised devices.
The role of the forensic copy
Recovery should never be attempted on the original medium with programs installed on it. First a full forensic image is acquired, including unallocated space, and the work is done on that. This way every attempt is repeatable and the original stays intact.
In short
- Deleting a file usually frees the space but does not immediately destroy the content.
- File system recovery keeps names and dates; carving works even without the index.
- Overwriting, TRIM on SSDs and encryption can make recovery impossible.
- Alternative copies often exist in backups, previews and synchronised devices.
- Recovery should be done on a forensic copy, stopping use of the original at once.