Computer forensics is not magic, in fact it is very technical in nature and can be very exacting. People always wonder how the computer forensics experts at can “conjure” up “stuff” from computers that the owners thought was gone. How does forensics data recovery work?
When it comes to files, forensic computer investigations and computer forensic analysis works from a three-pronged approach.
The first is to recover files as we users know them. For example, a Word document or an Excel worksheet or workbook. These are files that openly exist on the computer. These are not files the user thinks has been deleted or removed. Although some of those could exist in their original form in the recycle or trash folders.
The second is the metadata. [...]