---
{
  "title": "Deleted files and recovery",
  "summary": "Deletion changes references and storage state; recovery is not guaranteed.",
  "topic": "forensics",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    2
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Integrating Forensic Techniques into Incident Response",
      "url": "https://csrc.nist.gov/pubs/sp/800/86/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Deleting a file often changes filesystem metadata before all content is overwritten, but behavior varies widely. Recovery can depend on storage allocation, encryption, snapshots, trimming, and subsequent writes. Recovered fragments may lack a reliable original name or complete structure. Preserve the source and distinguish a reconstructed file from an intact active file. Document which bytes or metadata were available and which were inferred.

## In practice

A forensic tool recovers a partial document from unallocated space. The report identifies it as incomplete and avoids assuming the original location without supporting metadata.

## A common misunderstanding

Deleted content is not always recoverable, especially when storage behavior or encryption prevents access.

## Check your understanding

Why avoid unnecessary writes to the source?

**Think it through:** New writes may replace recoverable data or alter metadata useful to the investigation.


## Deletion does not have one universal outcome

Deleting a file can remove or change references while some content remains, but actual recovery depends on the filesystem, storage behavior, encryption, subsequent writes, and other factors. Solid-state storage maintenance and discard behavior can further affect availability. Do not promise recovery simply because a familiar undelete tool exists.

Recovery can use different sources: filesystem structures, snapshots, backups, application versions, synchronized copies, or carving. Each has different completeness and context. A recovered copy may be older than the deleted file or lack its original metadata. Preserve the distinction between recovering content and reconstructing its full history.

## A fictional missing course document

An academy discovers that a course document was deleted. The response team first limits unnecessary writes where appropriate and identifies available version history and protected copies. An application-level version may provide a more usable result than raw carving, while forensic examination may still be needed to understand the deletion.

Restoration and investigation have related but different goals. Returning a useful document to staff does not establish who deleted it, and identifying a deletion event does not guarantee the latest content can be recovered. Record the source and age of any restored copy so users understand what work may need reconciliation.

## Compare recovery sources

Using a fictional document, describe recovery from a backup, an application version, and a carved object. State what content and metadata each might preserve and what uncertainty remains. Choose the most appropriate source for a business restoration question and explain why. Use prepared training media rather than deleting important files to see whether recovery will work.

## Keep exploring

- [[disk-imaging]]
- [[file-carving]]
- [[computer-forensics]]