This is information that appears to be gone but is still recoverable from the computer system. Until data are overwritten or wiped, they can be restored through use of undelete or restore commands. As deleted files may be overwritten when a new file is saved, new software is loaded, or unused space is wiped, the amount and type of residual data that can be recovered varies. Residual data can be buried in a number of other places on disks and drives. Forensic specialists have tools that allow them to examine the entirety of a drive for residual data.
Computers also contain information about the information they store.
Every computer contains its own kind of audit trail. That information can be golden in the face of a witness' denial that he or she had knowledge of certain facts. Also recorded within a computer's own self-maintenance system may be information about who modified a file last and when the modification was made. An audit trail may indicate when and by whom files were downloaded to a particular location, copied, printed out, or purged. In addition to using a network's audit trail, an increasing number of companies are installing software designed to monitor employees' use of company computers.