Deleted does not always mean gone
Deleting a file usually removes the reference to it rather than the contents.
The data sits there until something else overwrites it, which is why recovery is often possible and why disposal needs more than deletion. It cuts both ways: useful when you are investigating, and a problem when you believed something was destroyed. On modern storage the behaviour is less predictable than it used to be, which makes assumptions in either direction unsafe.
More on Digital forensics
- Forensic copies protect original evidenceMark the copy, never the original
- Hashes can show evidence stayed unchangedThe same short string, twice
- Timestamps need interpretationOne moment, three different times
- Memory can reveal what disk cannotIt has to unwrap itself to run
- Forensic tooling can change the thing examinedYou leave prints of your own
- Cloud forensics depends on provider evidenceYou get what comes through the hatch