Deleted Files

This referes to a file state in which the area that a particular file occupies is available to be overwritten by the operating system as part of routine operation.  If a subject knows there are incriminating files on the computer, he or she may delete them in an effort to eliminate the evidence. Many computer users think that this actually eliminates the information. However, depending on how the files are deleted, in many instances a forensic examiner is able to recover all or part of the original data.(2)