1) When a file is deleted, the data is not erased but rather the computer marks the file's space as empty and available to be overwritten. 2) A forensic analyst can use data recovery tools to find deleted files by searching the hard drive clusters where the file was stored. 3) Overwriting or shredding a file deliberately fills its old storage space with random data to prevent recovery of the original contents.

1. Is a Deleted File
Really Gone?
s1240122 Tetsuro Ishizuka

2. Abstract
• When you delete a file, by
accident or on purpose, is
the information really gone?

3. Object
• Experiment to see what it
takes to completely delete a
computer file.

4. Introduction
• In a criminal case, Whether it
was deleted or not is the job
of a forensic computer
analyst to find out the
answer.

5. Introduction 2
• When a file is saved to a
computer's hard-disk drive,
the file is stored in multiple
sections, called clusters, on
the hard drive.
• The computer only saves a
file to clusters of the hard
drive that it thinks of as
"empty."

6. Introduction 3
• If you select a file and press the
delete button, the file will go in
to a folder marked Trash if you
are using a Mac, or marked
Recycle Bin if you are using a
Windows computer.
• It also signals to the computer to
think of those hard drive clusters
as "empty" again, even though
there is information sitting in
them.

7. Introduction 4
• Once the computer thinks of
the hard drive clusters as
"empty," it can store other
files in those spaces by
writing over the information
that was previously in them.

8. Introduction 5
• Sometimes people
deliberately write over a file to
keep the data secret.
• This is called overwriting or
file shredding

9. Terms and Concepts
• Forensic computer analyst
• Hard-disk drive
• Hard-disk drive clusters
• Deleting a file
• Data recovery
• Overwriting files
• File shredding
• Operating system
• File extension

10. Materials and Equipment
• Mac or Windows operating
system

11. Procedure 1
• Make sure you know how to
use them to find a file on the
computer's hard drive and in
the computer's Trash (Mac) or
Recycle Bin (Windows).

12. Procedure 2
• If you do not already have a
file recovery tool on your
computer, you will need to
find one, download it, and
install it.

13. Procedure 3
• Lastly you will need to find,
download, and install a file
shredding program on the
computer.

14. Learn More
• Information Security
Analyst
• Computer Software
Engineer
• Computer Hardware
Engineer

15. Conclusion
• The file is not actually
disappeared, and it is in the
"empty" state。