Roman Locher (Arina AG)

Abstract

Deleted data exists on pretty much any storage device. Usually the operation system and the running processes are responsible for generating the majority of deleted files on a system. But if deleted objects have been caused through user action, we can expect that the content of those files might be interesting for our investigation. We will show you which different types of deleted data exist, how they are created and what recovery techniques in forensics products are available today.