Unit Summary

This unit explained the various ways on how to delete a file. Deleting a file does not necessary mean that the file has been lost permanently. The fact that an entry has been removed from the file allocation table makes the file invisible to the operating system; however the file is still on the disk and can be recovered as long as the file location has not been overwritten. To restore the file, different computer forensic tools have been discussed. Furthermore, partitions can also be recovered, as discussed in this unit. 

Moreover this unit also illustrated how to acquire the data without tempering the information. Lastly while searching and collecting vital information, the Windows Registry should be examined. In this unit, we have shown the different registry path to obtain significant information.