A common belief among many people is that when a file on a computer is deleted, it is gone forever. Contrary to the popular belief, the file is not gone forever. l learned this in my Computer Forensics class which Canisius offers as a part of the Forensic Accounting program.
Our first project in this class was to analyze our own flash drive. I used a flash drive that I had since high school, but it only had about 30 recent files on it. Well, so I thought it only had 30 files on it.
With a program called Forensic Toolkit Imaginer, a forensic copy of the flash drive was created. A forensic copy is a bit for bit digital copy of an original digital file, image, or disk. This is created so the original file is not tampered with in any way. Forensic Toolkit takes the forensic copy of the flash drive and analyzes it. This process took a lot longer than I expected because of the amount of information on the flash drive.
When the process was done, I realized that there were more than 30 files on the flash drive. The tool brought up word documents, presentations, and pictures from high school and college. I had deleted these files a long time ago. However, even though I deleted them, they still remained on the flash drive.
When a file is deleted, it is not actually gone forever. The file name is changed just a little so the system knows to ignore it and the space where the file was stored is declared vacant. The file is still on the flash drive, you just can’t see it. So, the next time you think you deleted a file from your flash drive or computer, think again, because it’s still there.