Attorneys who need to read and understand reports by computer forensics professionals and/or who need to present recovered files as evidence should understand how files are stored on computers and mobile devices, what happens when they are deleted, how they can be recovered, and know the limits on file recovery.
Before diving into the details of deleted files and how they are recovered, we need to understand how files are stored. Every computer storage device--hard drive, thumb drive, SSD, CD-ROM--has a "filesystem" that dictates how files are arranged and stored on that device. Filesystems maintain metadata about each file they store including the name of the file, the user who created or owns
the file, the time it was created or modified, and the addresses or locations where the file is actually stored. They also divide their storage space into allocation units or "blocks" to make it easier to manage.