www.ExpertDataForensics.com
Tel: 888-355-3888
eForensic Focus
How Unallocated File Space Can Help Your Case
Technology has opened a door to a world of new ways of storing and obtaining important data. The internet, computers, cell phones, PDA’s and other electronic devices that have memory storage enable us to communicate and save information electronically. When this is done, the data is saved into the memory disk of the device. So, if you own a laptop or desktop computer, all the files you use on and off the internet are saved onto your hard drive. All of these files are allocated, meaning they are able to be easily accessed by the user. The same goes for cell phones and PDAs; whenever a number is dialed, or a message is texted or the internet or other applications on the device are used – the data is saved into mini-disk memory storage.
What’s the Difference between Allocated and Unallocated Files?
Files that have been erased by the user are no longer accessible to him or her because they are relocated to unallocated file space. For instance, if you have a Word document and delete it into the trash can and then empty the trash can, you are no longer able to find that file.
With allocated files, they are stored in folders, on the desktop or elsewhere on the device. These files can be easily found by the user. Another term for allocated file space is active file space.
The retrieval of Unallocated File Space
Now, you may be thinking, “How can unallocated file space be accessed if they are inaccessible?” Well, this is where data forensic experts come in. Users may think that when files are deleted and the trash can is emptied, that they are permanently erased, but this isn’t so. When files are erased on DOS, Windows, Windows 95, Windows 98 and Windows NT, the data from the file remains on the unallocated storage space. That is, unless of course, DiskScrub, M-Sweep or other DoD certified file deletion software has been used.
The data that is left behind is retrievable through system recovery and computer forensics software utilities.
The data that is retrieved is coded in computer language, which must be decoded either by the system recovery or data forensic specialist.How Unallocated File Space Can Help Your Case.
