Assessing Trace Evidence Left By Secure Deletion Programs

This paper, published in International Federation for Information Processing, Volume 222, discusses whether trace evidence of files is left by Windows-based secure deletion programs. Secure deletion programs purport to permanently erase files from digital media. The authors examine five popular deletion programs to determine if identifiable signatures are left in the system after a file is deleted. Results show that some programs leave identifiable signatures, sometimes including file metadata, which enables forensic investigators to extract various types of information from deleted files.