Mason Archival Repository Service

Identifying Factors Affecting Deleted File Persistence Through Empirical Study and Analysis

Show simple item record

dc.contributor.advisor Jones, James H Khan, Tahir M
dc.creator Khan, Tahir M 2018-10-22T01:21:20Z 2018-10-22T01:21:20Z 2017
dc.description.abstract Computers store persistent information in a non-volatile storage device such as a hard drive. Users directly create and delete files on the hard drive, and users install and uninstall applications which indirectly creates and deletes files. The operating system, e.g., Windows, uses a file system, e.g., New Technology File Systems (NTFS), to manage and organize files on a storage medium. The file system is responsible for tracking allocated and unallocated space on the storage device, where files are stored in allocated space and unallocated space is available for future storage. When a file is deleted, most file systems do not overwrite the file's data immediately. The file system simply removes the deleted file’s reference point from the containing directory and file system structures, and the areas holding the deleted file contents are now available to the system for storing other files. The file system overwrites the deleted file contents gradually over time, and some deleted file contents may remain intact on the disk drive for days, months, or even years if the file system does not write new data to a particular location on the disk.
dc.format.extent 204 pages
dc.language.iso en
dc.rights Copyright 2017 Tahir M Khan
dc.subject Information technology en_US
dc.subject deleted files en_US
dc.subject digital file persistence en_US
dc.subject digital file persistence factors en_US
dc.subject digital forensics en_US
dc.title Identifying Factors Affecting Deleted File Persistence Through Empirical Study and Analysis
dc.type Dissertation Ph.D. Information Technology George Mason University

Files in this item

This item appears in the following Collection(s)

Show simple item record

Search MARS


My Account