eBook - Forensics and the World of eDiscovery Vol.1 May, 2014 | Page 10

Chapter 4

Carved, Deleted, Orphaned Data
Computers are useless. They can only
give you answers. -Pablo Picasso

It is commonly known that when a file is
deleted on a computer, it may not be
immediately inaccessible. Deleted files
can be recovered from recycle bins and
trash cans.
Even after emptying these, files can
persist as orphaned or double-deleted
data that may be instantly recovered
using the file system. In a case where
data is not instantly recoverable, data
carving may locate fragments of files
through intensive data scanning.