How Unallocated File Space Can Help Your Case
Technology has opened a door to a world of new ways of storing and obtaining important data. The internet, computers, cell phones, PDA’s and other electronic devices that have memory storage enable us to communicate and save information electronically. When this is done, the data is saved into the memory disk of the device.
What’s the difference between allocated and unallocated files?
Files that have been erased by the user are no longer accessible to him or her because they are relocated to unallocated file space. For instance, if you have a Word document and delete it into the trash can and then empty the trash can, you are no longer able to find that file.
With allocated files, they are stored in folders, on the desktop or elsewhere on the device. These files can be easily found by the user. Another term for allocated file space is active file space.
The Retrieval of Unallocated File Space
Now, you may be thinking, “How can unallocated file space be accessed if they are inaccessible?” Well, this is where data forensic experts come in. Users may think that when files are deleted and the trash can is emptied, that they are permanently erased, but this isn’t so. When files are erased on DOS, Windows, Windows 95, Windows 98 and Windows NT, the data from the file remains on the unallocated storage space. That is, unless of course, DiskScrub, M-Sweep or other DoD certified file deletion software has been used.
The data that is left behind is retrievable through system recovery and computer forensics software utilities. The data that is retrieved is coded in computer language, which must be decoded either by the system recovery or data forensic specialist.
By Expert Data Forensic Investigation
Computer Forensics, Data Recovery and Investigations Expert Witness Services
ABOUT THE AUTHOR: Adrian Leon MareComputer Forensics, Data Recovery and Investigations Expert Witness Services
Our company is an independent private investigation firm dedicated to helping legal counsel, government, individuals and organizations in forensic examination and recovery of electronic data and eEvidence. We secure, analyze, recover and investigate electronic data and eDiscovery. We assist in litigation, civil matters, domestic disputes and criminal investigations.
Copyright Expert Data Forensic Investigation
Disclaimer: While every effort has been made to ensure the accuracy of this publication, it is not intended to provide legal advice as individual situations will differ and should be discussed with an expert and/or lawyer.For specific technical or legal advice on the information provided and related topics, please contact the author.
