Lecture 1.1: The Myth of Deletion & The Reality of Storage

Digital Forensics is often called “Digital Archaeology.” We are digging through layers of data to find the truth. Learning this field will change how you look at every device you own. You will realize that your phone, your laptop, and even your smart fridge are constantly “witnessing” your life and recording it in places you didn’t know existed.

1. The Persistence of Data: Why Nothing is Ever Truly Deleted

When you right-click a file and select “Delete,” or even when you empty the “Recycle Bin,” the data is not erased.

Imagine a hard drive as a massive city.

• The File System is the map of the city.
• The Data are the actual buildings.
• Deleting a file simply tells the map: “This plot of land is now vacant; you can build something else here later.”

Until the computer actually needs that space and “builds” a new file over it (Overwriting), the old building is still there. It’s just invisible to the average user. As a Forensic Analyst, we ignore the map and look directly at the ground.

1.7: The Physics of the Evidence Container

The medium dictates the mission. As an analyst, your first question isn’t “What was deleted?” but “What was it stored on?” This determines your “Window of Opportunity.”

• HDDs are like a Vinyl Record: Even if you scratch out the name on the label, the grooves in the wax remain until you melt them down.
• SSDs are like a Whiteboard: They are designed to be erased quickly so they stay clean for the next person to write.
• Flash (USB/SD) is like a Game of Musical Chairs: Data is constantly jumping from one seat to another to ensure no single seat breaks from over-use.

[SYSTEM] Awaiting device connection for bit-stream acquisition...

Forensic Background for your Investigation:

• When an investigator handles a drive, the Physical Layer (what you see in the animation) dictates the Logical Layer (what you see in the Hex dump).
• HDD Physical Persistence: Because magnetism is a physical change on a ceramic/metal disc, the data is essentially “engraved.” Even if the OS deletes the pointer, the engraving remains.
• SSD Deterministic Wipe: SSDs use a process called Static/Dynamic Wear Leveling. The drive is constantly playing a “shell game” with your data to ensure no single NAND cell burns out. When TRIM is active, the drive doesn’t just forget where the data is; it actively clears the “shell” entirely.
• Flash Ghosting: On USB drives, there is no communication (TRIM) between the OS and the drive. When you delete a file, the drive doesn’t know it’s gone. Because of wear leveling, a single file might have been moved 5 times, leaving 5 older versions of itself in the “Over-provisioned” area of the chip.

2. Understanding Storage Media: The “Evidence Containers”

To find this “deleted” data, we have to understand how different media store bits.

A. HDD (Hard Disk Drives): The Magnetic Memory

HDDs use magnetism. Data is stored on spinning platters. Because magnetism can be persistent, even if a sector is marked as “free,” the magnetic orientation remains until a new file is written.

• Forensic Advantage: High recovery rate for deleted files.
• Risk: Mechanical failure. If the platter stops spinning, we need “Clean Room” surgery to recover data.

B. SSD (Solid State Drives): The Electronic Flash

SSDs are faster but more complex for forensics. They use a process called TRIM. When you delete a file, the SSD controller tries to “clean up” the cells immediately to keep the drive fast.

• Forensic Challenge: Once TRIM runs, the data is often physically wiped much faster than on an HDD. Time is of the essence.

C. SD Cards & USB Flashes

These use “Wear Leveling.” To prevent the drive from wearing out, the controller moves data around to different cells.

• The “Ghost” Effect: You might find three different versions of the same document in three different physical locations on the chip because the controller moved them during saves.

3. Thinking Differently: The Forensic Perspective

Once you understand forensics, you stop seeing a “File” and start seeing Artifacts.

• Timestamps: Every file has a “MAC” (Modified, Accessed, Created) history. Even if you don’t open a file, the system might “Access” it to create a thumbnail, leaving a forensic footprint.
• Slack Space: Files rarely fit perfectly into storage blocks. If a block is 4KB and the file is 3KB, there is 1KB of “Slack Space” that can contain fragments of previous deleted files.

4. Interactive Lab: The “Empty” Drive Investigator

Let’s see if you can identify where data is hiding in a supposedly “clean” system.

5. Why this is the “Lame” (Underused) Field

You mentioned that Forensics is often misused or ignored. This is because most people in Cyber focus on “The Heat of the Moment” (Stopping an attack).

• The Hacker’s Mistake: They think that by stopping their script or clearing a log, they are safe.
• The Analyst’s Edge: We know that the storage media never lies. A computer cannot perform an action without leaving a physical change on a disk or in memory.

By learning Forensics, you become the person who can prove exactly who did what, and when. You become the source of truth.

What’s next?

Now that we understand that data persists, we need to talk about The Integrity of Evidence. In the next lecture, we will cover Hashes and Write Blockers—the tools we use to make sure we don’t accidentally “map over” the very buildings we are trying to investigate.