Fact: Nothing Gets Deleted

by | Nov 8, 2019



When you delete a file, even after emptying the recycle bin, it orders your OS to make it look like its deleted by removing the knowledge of where it is. With data, you can only rewrite on top of what is there, replacing the old data with new (Can be Binary and sometimes referred as file shredding, or data wiping which removes the empty space, therefore rewriting on it).

Therefore any software that restores data, is based on the file carving techniques which is the process of reconstructing files by scanning raw bytes of the disk and reassembling them, or working with pointers of the files, therefore choosing speed over accuracy of rewriting over the file which takes time.
File carving works only on raw data on the media, and it is not connected with file system structure & doesn’t care about any file systems which is used for storing files, powered by Linux & used by forensic analysts who recover sensitive files when you though its deleted. ( i.e Foremost, Scalpel etc..)



Meaning: If you delete a file from the cloud, a memory card, a USB Stick, your phone, or any device, (Except some SSDs which support TRIM capabilities ) depending on the situation and the value the of files they have to you.
Besides backing up/restoring which is a common solution, but not enough against more sophisticated spreading of ransomware targeted attacks, due to the real fact that many do not invest in storage solutions, or the configuration is not well performed,
many offer deduplication techniques, AI Implemented Storage Management services, and more, to restore without downtime. These Solutions are sometimes implemented by LARs, the SMB and End Users cannot afford sometimes such options, but Digital Computer Forensic Techniques can take place as a SaaS, even remotely to analyze and recover deleted files, using recovery techniques like file carving extracting data from storage devices without the assistance of the file system that originality created the file. It recovers files at unallocated space without any file information and used to extract data out of raw data, based on formats of specific characteristics presented in the structured data in case you get hit by data loss disaster.



Share This