How does the FBI is able to recover evidence from computer hard drives even after the user has deleted files?

Answer 1

First, "delete" does not mean "erase," but rather "release memory for other use." The data may sit around un-used on the drive for years.

Second, even if all of the pieces of the file have been erased (overwritten), magnetic media, such as computer hard drives (or floppies or tapes) continue to have "residue" of earlier usage, which can be interpreted and used to re-constitute the earlier data stored there.

Answer 2

Computer forensics is a growing field with constantly evolving tools.

In any case, deleting a file does not remove it from your computer, it simply removes the index files that tells the computer where it is. There are many freeware tools that will recover deleted files that people use to find accidentally files. Until and unless a hard drive is physically destroyed it is very possible that data will be recovered.

Answer 3

Most computer file systems do not overwrite all the information in a file when the user asks for the file to be removed. Instead, the space of the "removed" file is returned to the file system for future use. The information is still present until the space is used for new information. Thus, the FBI (or anyone) can use a variety of tools to examine this residual information.

Specifically, many file systems use a concept of "inodes" which can be thought of as pointers to segments of information. When that information is no longer needed (i.e. "deleted") the inodes are used to indicate which space is free.

Even if the information is overwritten once with "0"s, it may be possible to recover some of the original information using advanced analysis tools.

Some operating systems, such as Apple's Mac OS, have a "secure delete" which actually overwrites the information on the disk several times with random bits. Often, seven random overwrites are used (a Department of Defense standard), and the process takes significantly longer than the normal delete.

A paper by Simson Garfinkel "Forensic Feature Extraction and Cross-Drive Analysis" provides references to several tools for recovering information from hard drives and performs an analysis on 750 used hard drives that shows that businesses often do not securely delete information they should.

Answer 4

The FBI uses a professional software to obtain deleted files. Files that you delete remain on your hard drive for some time. Old files that are deleted are written over by newer files that you use. You can obtain software similar to this online.

Answer 5

Deleted files are usually still there. Only way to be absolutely sure files are totally gone is to reformat the drive. Deleted files are invisible unless you know the special ways to find them, which the FBI does.