Forensics: When was a File Deleted? Part 1

Was the file deleted before his resignation?”

Was the file deleted before or after the data preservation order?”

If the file was deleted on the 1st rather than the 31st, than that means there was a breach of a court order. Can you say when it was deleted?”

All of these questions are asking the same thing: “When was a file deleted?”; this article looks at this issue (for Windows operating systems)

Deleted Dates

Broadly there are two scenarios for when a file is deleted, it is deleted via the recycle bin and when the file is not deleted during a recycle bin.

Deleted Dates: Recycle Bin

If a user hits the delete key on a file it, in virtually all scenarios, goes to the Recycle Bin in Windows. Windows 9x, 2000, XP, and Vista all have a recycle bin/trash bin. Many users are familiar with this and know that if they delete a file, they can go into the recycle bin and recover it at a later date.

What many users are not aware, but all forensics investigators should be, is that when a file is placed in the recycle bin the date that occurs is recorded. i.e. the date of deletion is recorded, if the file is deleted file the recycle bin. This information is recorded via the INFO2 file in Windows 9x, 2000 and XP. In Vista the information is recorded, but it’s in a slightly different location.

Therefore if a file is deleted via the recycle bin the information is easily obtained.

If the recycle bin is emptied, can the deleted date still be recovered?

Yes, for a period of time. The information about the deleted date is, itself, deleted after the recycle bin is emptied. This means that the information can be recovered using data recovery methods. But as it is not a file that is being searched for, but rather metadata about the deleted file, it is only a fragment of data that needs to be recovered.

Therefore methods such as keyword searching and date carving are required to locate this information.

Why does the file not go into the recycle bin?

Not all files are deleted via the recycle bin, this can occur for couple of reasons. The most common are:

  1. System deletion: If the computer deletes files, automatically, e.g as part of the routine cleanup, the files do not go via the recycle bin
  2. User initiated system deletion: If a user clears the internet history, or uninstalls a program, then the system deletes files. These files do not go to the recycle bin.
  3. Third party tools: If an individual runs a deletion tool such as EvidenceEliminator those files that are deleted do not go via the recycle bin. Therefore their dates of deletion are not recorded (in the recycle bin, though they may be elsewhere, see Part 2)
  4. Shift-Delete: If a user presses shift and delete when deleting a file the file is “hard deleted”, this means that the file does not go to the recycle bin, it is simply deleted. In this case the dates of deletion are not recorded by the recycle bin.

Part 2 will cover the issue of determining the deletion dates of files that are deleted via the recycle in.

Advertisements

5 Responses to “Forensics: When was a File Deleted? Part 1”

  1. Forensics: When was a File Deleted? Part 2 « Data – Where is it? Says:

    […] When was a File Deleted? Part 2 Posted on August 17, 2009 by 585 Following on from “When was a File Deleted? Part 1” this article discusses how the identify the data of files that have not been deleted, but not […]

  2. Ryan Says:

    Hi, thanks for the above article. I find myself in one of the situations you describe, trying to find out when an employee deleted all his information – I’m pretty sure, given his level of computer literacy, that all files were deleted via the recycle bin, which was then emptied. I have recovered the files themselves, but the key issue for me is the date of deletion, which I need to prove. I am unable to find this INFO2 file, do you have any suggestions? The machine is running XP.

    I would really appreciate any help.

    Thanks and regards,

    Ryan

    • 585 Says:

      The INFO2 should is almost always be there, its unusual for it not to be. Its not unusuall, however, to find it empty.

      If files have been deleted via the recycle bin and the recycle bin emptied then the relevant information within the INFO2 can be missing. In these cases it can be possible to carve out the relevant data from unallocated space. i.e find the information that was in the INFO2 file but is now elsewhere on the drive. There are tools for this and EnCase has functionality for this.

      If no such information exists or the files were deleted without going via the recycle bin, then getting information about the deletion of the file.

      However, some of this information can be obtained by looking for other artefacts, for example an old LNK file may show where the deleted file used to exist, as may registry entries.

      Without the INFO2 the date of deletion may just be put down to a range. I.e. If you if you know when the file was last accessed you can say that the file was deleted after that date, and not before it, but not much else

  3. raj Says:

    Is it possible to find the date of deletion from a phone memory card ? I have used several recovery softwares but they show the date of deletion as the date it was created.

  4. Execs Says:

    If the date on the computer is changed (to a old date) then a file is deleted then the information we get, if any, about that deleted file is that old date only.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: