Home/Investigations/32
Illustration for investigation 32: Deleted computer files can sometimes be recovered.
CASE FILE 32

Deleted computer files can sometimes be recovered.

Evidence verdict: supported

Deleting a file often removes its directory entry while the underlying data remains until overwritten. Recovery depends on the device, filesystem, encryption, trimming and later use. Secure erasure and modern solid-state drives change the result.

RIDBUSTERS

What we found

On many systems, deletion marks storage space as available rather than immediately erasing every bit. Specialist software may reconstruct data if new information has not replaced it. SSDs can use TRIM to clear blocks, and encryption may make remnants useless without keys. Recovery is therefore possible in some cases, never guaranteed. The Ridbusters then compare the wording with the original sources, look for the conditions of each observation and check whether another explanation could fit. That turns a surprising headline into a trail a young investigator can follow: claim, test, result and remaining uncertainty. Deleting a file often removes its directory entry while the underlying data remains until overwritten.

Return to investigationsContinue investigating