Identifying Factors Affecting Deleted File Persistence Through Empirical Study and Analysis

Abstract

Computers store persistent information in a non-volatile storage device such as a hard drive. Users directly create and delete files on the hard drive, and users install and uninstall applications which indirectly creates and deletes files. The operating system, e.g., Windows, uses a file system, e.g., New Technology File Systems (NTFS), to manage and organize files on a storage medium. The file system is responsible for tracking allocated and unallocated space on the storage device, where files are stored in allocated space and unallocated space is available for future storage. When a file is deleted, most file systems do not overwrite the file's data immediately. The file system simply removes the deleted file’s reference point from the containing directory and file system structures, and the areas holding the deleted file contents are now available to the system for storing other files. The file system overwrites the deleted file contents gradually over time, and some deleted file contents may remain intact on the disk drive for days, months, or even years if the file system does not write new data to a particular location on the disk.