File & Data recovery

After completing FOR500.1 this is the second and last article which summarize this book 🤺

You delete a file… and think it’s gone forever. 💭

But in Digital Forensics, deletion is often just the beginning. Let’s break down how Data Recovery actually works in the real world. 💻

First, we need to understand a key concept: Delete does NOT mean data is erased. ❗ In most file systems, the operating system only removes the file reference, while the actual data remains on disk until it is overwritten. This is where recovery begins. 🔁 Another critical concept is how storage is structured: Allocated space is currently used by active files, while Unallocated space is no longer linked to files but may still contain remnants of deleted data. This is exactly where investigators focus, because deleted files often remain in unallocated space until overwritten. 🧠

At the core of NTFS lies the Master File Table (MFT). Every file and folder has an entry that stores metadata such as file name, timestamps, and data locations. If the MFT record still exists and the data clusters have not been overwritten, we can perform Metadata Recovery and fully restore the file. 📂

But what if metadata is gone? This is where File Carving comes in. Instead of relying on the file system, we scan raw data for file signatures (headers and footers) to reconstruct files. It works well for formats like JPG, ZIP, and EXE, but struggles with fragmented files and may produce false positives. ⚠️

At a more advanced level, we have Stream Carving, which extracts valuable fragments such as URLs, chat messages, emails, and browser activity instead of full files, making it especially powerful in modern investigations. 🌐

Another powerful technique is String Searching. By scanning data at the byte-level, investigators can extract readable text such as emails, URLs, IP addresses, and passwords. Even if a file cannot be fully recovered, its content may still exist as text fragments, providing critical evidence. 🔎

Another major source of evidence is Volume Shadow Copies (VSS), which are system snapshots that preserve previous versions of files and folders, meaning even if a file is deleted or modified, older versions may still exist. 🕰️ 🔥 And that’s not the only hidden source…

there is another often-overlooked artifact: the Windows.old folder. This folder is created after a Windows Update or system reinstallation and stores a copy of the previous system, including old user files, registry hives, event logs, prefetch files, and installed programs. This means even if files were deleted before an update, they might still exist inside Windows.old. 💡 This folder can remain for around 30 days or more until it is removed by the system, making it a valuable source for data recovery, especially after system updates. 📁

Now, let’s talk about storage types. On traditional HDDs, deleted data often remains recoverable for longer periods because it is not immediately overwritten, while SSDs introduce major challenges ⚡ due to technologies like Wear Leveling, TRIM, and Garbage Collection, which actively remove or relocate data, significantly reducing recovery chances. In simple terms: HDD → Data lingers, SSD → Data disappears faster 📉 So what determines whether recovery is possible?

Two main factors: metadata still exists and data has not been overwritten. If both are true → recovery is highly likely, if not → we rely on carving and string searching, with no guarantees. ⚖️

Digital forensics is not magic. It’s about understanding how data is stored, how it changes over time, and where to look when it disappears. 🧩 And sometimes… the most important evidence isn’t in what you see, but in what was left behind. 👣

#DFIR #DigitalForensics #CyberSecurity #IncidentResponse #BlueTeam

Thanks for reading. 🩵