Glossary term
Deleted File Recovery
Deleted file recovery is the process of reconstructing files that have been removed from the visible file system, using forensic examination of file system metadata, unallocated space, and residual artifacts.
On most modern file systems, deleting a file does not erase its content. The file system simply marks the storage as available for reuse. Until that storage is overwritten by new data, the file content survives in unallocated space.
File system metadata (the Master File Table on NTFS, the catalog file on HFS+, the inode table on ext4) often retains references to deleted files for some time after deletion, including the file name, size, and original location. Even after metadata is overwritten, fragments of file content can survive in slack space or unallocated clusters.
Modern SSDs complicate recovery because the TRIM command can erase unallocated content quickly. Modern phones with whole-disk encryption complicate recovery further because losing the encryption key effectively destroys all unallocated content.
For Canadian counsel, deleted file recovery is often the strongest evidence in employee data theft, family law, and internal fraud matters.