Uncover "deleted" file information that persists, hidden in your system

With many computer systems, deleted file information remains intact on the disk, in unallocated data blocks and unallocated file attribute blocks, until it is overwritten in the course of other activity. This can result in unexpected disclosure of information when a machine or its disk is retired and resold as secondhand equipment.

In this chapter download from Computer Forensics Library Boxed Set, study how deleted file information can escape destruction intact for months or even years and how deleted file attribute information can provide insight into past system activity. Examine several systems and discover how well past activity can be preserved in an unallocated disk space, then learn why deleted file information can be more persistent than ordinary file information.

Title: Computer Forensics Library Boxed Set
Author: Keith J. Jones, Richard Bejtlich, Curtis W. Rose, Dan Farmer, Wietse Venema, Brian Carrier
Publisher: Addison Wesley Professional
Chapter 7: The Persistence of Deleted File Information
ISBN: 0-321-52564-7; Copyright 2008 Addison Wesley Professional. All rights reserved.
Used with permission from the publisher. Available from booksellers or direct from Addison Wesley Professional