|
|
 |
 |
|
|
Are Deleted Files Completed Erased?
A common misconception is that when information or a specific file is deleted, it is permanently erased from the hard drive. In reality, the act of deleting a file does not actively delete any information. What occurs is a small portion of information that points to the location of the file on the hard drive is erased.
This pointer is used by the operating system to compile the directory tree structure and by removing this pointer file, the actual file becomes invisible to the operating system, although it still exists. Overtime, the location of the unwanted file will be over written by new information.
The only manner in which to actually completely erase a file is to overwrite it. Therefore, the longer the pointer in the directory tree structure is erased, the greater the likelihood that the file will be automatically overwritten. In addition, many overwrite products exists that can be used to automatically and permanently erase files.
Whether or not a file has been either deleted or overwritten, forensic technology exists to identify, reconstruct, and recover information and rebuild files. If a file has been completely overwritten and made non-recoverable through the use a specialized deletion tool, forensic techniques may still reveal that such a tool has been utilized and the file name of the overwritten information, which can often act as damning evidence in and of itself.
|
|
|
|
|
|
