The most important thing to know about digital forensics investigations is delete does not mean "erase". To most of us, pressing Delete or emptying the recycle bin is the bitter end for unwanted files. It disappears from Finder or File Explorer, so it must be gone for good, right?
Not to a computer forensic examiner. With our specialized tools, we can search drives bit-by-bit, discovering and piecing together remnants of files users believed to have disappeared, never to be seen again. Resurrecting these “ghost files” is the hallmark of the digital forensics field, and the source of the most valuable information we will provide.
Even when data clusters are scattered across a disc, digital forensic analysts can piece files back together through a detailed process called file carving. By examining the metadata of file clusters, analysts can find which clusters are most likely associated with one another and potentially recover the deleted file.
Back To Glossary