Forensic Preservation

Many people think that when you delete a file, it's permanently erased from the storage medium. In reality, the information is still there. All that is erased is a small portion of the information that points to the location of the file. This pointer is what operating systems use to show the directory structure. What happens is that the deleted information becomes invisible to the operating system and the user. Over time the location of the deleted file will be overwritten by new information.

Preserving data that may be involved in litigation is important and may be the subject of a preservation letter. Creating a Forensic image as soon as possible can preserve deleted data before being overwritten.