Cyber Forensics: Where Digital Evidence Hides

What you'll be able to do

You will be able to list where digital evidence can be found, and explain why deleting a file does not necessarily make its underlying data immediately unrecoverable — and when it can.

• Name the main places evidence hides, on and beyond a single computer.
• Explain what "deleting" actually does on a traditional hard disk.
• Recognise four situations in which deleted data may really be gone.

What cyber forensics is

Dr. Al-Doori explains that digital forensics, computer forensics and cyber forensics mean roughly the same thing: the science of collecting, examining, analysing and reporting electronic evidence. The aim is evidence that can be trusted, including by a court. Investigators may work for the police, for a company looking into an incident, or for lawyers in a dispute.

The book's starting question is simple: where does the evidence live? The quotation that opened this unit in Lesson 6.1 makes the same point: the machine itself matters less than the thousands of files and traces inside it.

Where evidence hides on a drive

To understand where traces survive, you need to know what "delete" really does on a traditional hard disk.

• Deleted files. When you empty the bin, the system usually just marks the file's entry as deleted and treats its space as free to reuse. The data itself stays on the disk until something new is written over it. Think of a library that removes a book's catalogue card but leaves the book on the shelf until it needs the space.
• Slack space. Storage is handed out in fixed-size blocks. When a file doesn't fill its last block, the leftover part — the slack space — may still hold fragments of older, deleted files.
• Free space. Areas marked "free" (also called unallocated space) may still contain pieces of earlier files.

That is why current guidance phrases it carefully: Deleting a file does not necessarily mean its underlying data becomes immediately unrecoverable.

When deleted data really can be gone

"Not necessarily" works both ways. At beginner level, there are four important exceptions:

1. Overwritten data. Once new data is written over the old, the old data is gone. The longer a busy device is used after a deletion, the less is likely to survive.
2. SSDs and TRIM. Many modern computers and phones use solid-state drives (SSDs) instead of spinning disks. SSDs have a feature called TRIM that tells the drive which blocks are no longer needed. Research suggests that on some SSDs, TRIM and the drive's own housekeeping may clear deleted blocks fairly quickly, so recovery may be much harder. How much survives depends on the drive, the operating system and the settings. This research is still developing, so treat it as a "may", not a rule.
3. Encryption. Many phones and newer Windows computers encrypt their storage by default. Microsoft's BitLocker documentation describes device encryption that newer Windows versions can switch on automatically on eligible hardware. Without the key, leftover fragments are unreadable scrambled data.
4. Cloud and service behaviour. For photos, messages and documents stored online, the service's own rules decide what happens after you press delete. An item may sit in a "recently deleted" folder for a while, survive on another synced device, or be removed from the service. What can be recovered depends on the provider, not on your own device.

Beyond the computer: sources of evidence

The book lists many sources beyond a hard disk, and the list has grown since:

• Phones — the phone's memory, its SIM card and memory cards, plus messages, call logs and app data.
• Cameras and photos — including location data stored inside the image (Lesson 6.5).
• USB drives and memory cards.
• Network, server and DNS logs — records of which device connected where, and when.
• Email headers — the routing record inside every email (Lesson 6.5).
• Cloud accounts — email, photo libraries, file storage and backups, now some of the richest evidence sources of all.
• Messaging apps and smart-home devices.

Each operating system also stores evidence in its own way, inside its file system — for example FAT and NTFS on Windows, and APFS, which Apple has used by default since macOS High Sierra and iOS 10.3. You don't need to know how these work; just remember that investigators must understand each one.

Volatile data is evidence that exists only while a device is switched on: the contents of memory (RAM), running programs, open network connections, signed-in sessions, and the keys of an encrypted drive that is currently unlocked. Switch the device off and it is lost. Lesson 6.4 looks at how investigators decide what to do about it.

Real-World Example

Imagine (a fictional scenario) a small design company whose former employee is suspected of taking client files before leaving. The company owns the returned laptop and phone, and it hires an authorised investigator.

• On the older laptop with a spinning hard disk, the investigator finds deleted copies of client folders in free space.
• On the company phone, which is encrypted and was reset before return, almost nothing deleted can be read.
• The strongest evidence turns out to be in the cloud: the company's own file-sharing logs show which files were downloaded, from which account, and when.

The lesson: evidence depends on the device, the storage technology and the services involved — and the investigator only examined what the company owned and authorised.

From the Book to 2026

What the book teaches. Deleted files usually survive until overwritten; slack and free space hold remnants; evidence lives on disks, phones, SIMs, cameras, USB drives, optical discs, networks and logs.

Why it made sense. For computers with spinning hard disks and no encryption, this was — and still is — accurate, and it explains why "delete" is weaker than people think.

What has changed. Security guidance has evolved since the original text. SSDs with TRIM, encryption switched on by default and cloud storage all change what survives a deletion. NIST's main forensics guide, SP 800-86 (2006), is still its current version, but it predates smartphones and cloud accounts, which now need their own collection methods. Floppy disks have left the list; cloud accounts, messaging apps and smart-home devices have joined it.

What to do now. Don't assume a deleted file has gone — and don't assume it can always be brought back. Before you sell or pass on a device, use its built-in reset or erase option rather than simply deleting files. As an investigator, check what kind of storage, encryption and cloud services are involved before deciding what to look for.

Watch: Digital Forensics — CompTIA Security+ SY0-701

This short professional overview by Professor Messer shows how the industry approaches evidence: carefully, with documentation, and always with an eye on a court case that may come years later. It is made for people studying for a security certification, so a few terms (such as "legal hold" and "e-discovery") go beyond this course — you don't need them.

As you watch, notice:

• how many places the video says evidence can sit — disk, memory, firmware, servers, network devices, firewall logs — and the less obvious ones, such as the recycle bin, temporary files and browser bookmarks or saved logins;
• why investigators work from copies rather than the original, and why mobile devices are a special concern because they can be erased remotely;
• why collecting data while a system is still running can matter when encryption locks the system once it is powered off.

The video reinforces what you just read — the lesson is complete without it.

What Would You Do?

A friend is selling an old laptop online. "I deleted all my photos and emptied the bin," she says, "so they're gone." The laptop is several years old and you're not sure what kind of drive it has.

What would you tell her, and what would you suggest she do before the sale? The answer note below resolves it.

Knowledge Check

Key Takeaways

• Forensics is the careful collection, examination, analysis and reporting of electronic evidence that others can trust.
• Deleting a file does not necessarily mean its underlying data becomes immediately unrecoverable — it may survive in free or slack space until overwritten.
• It may really be gone when it has been overwritten, cleared by SSD TRIM, protected by encryption without the key, or removed by a cloud service.
• Evidence lives far beyond one computer: phones, SIMs, photos, logs, email headers and, increasingly, cloud accounts.
• Only inspect, test or change devices, accounts and systems you own or are explicitly authorized to work with.

Sources

• NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• Microsoft Learn — BitLocker overview
• Apple Developer — Apple File System Guide
• arXiv (academic preprint, used cautiously) — SSD Forensic: Evidence Generation and Forensic Research on Solid State Drives Using Trim Analysis (2023)
• Professor Messer — Digital Forensics — CompTIA Security+ SY0-701
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 21