Deletion Tracking
Deletion Tracking

Spoliation is a legal concept. We don't make those claims. On the other hand, we know the technology of deletions and we can report extensively on the deletion activity on a computer.

Were files deleted? Was the deletion inadvertant? Was a file shredder used? We write File Deletion Reports all the time, distinguishing the thousands of standard operating system actions from the user-initiated deletions.

Everyone claims they can find deleted files. That's because, for the most part, recovering deleted files is pretty simple.

Here's an interesting concept. There are deleted files all over the disk that are embedded. It takes special software to carve these files out and recover them.

And for those files that can't be recovered, what might be discovered?

There are dozens of clues, ranging from deleted recycle bin databases to restore point logs to internet history to shortcut files. There are, literally, dozens of steps in pursuing the deleted files tracking history.

And, in some cases, especially when files are suspiciously absent, we'll find evidence of a shredder - special software that permanently hires files.

Here are some relevant case studies:

The CD Burning Party
Destruction of Evidence