As a result, many corporations and government agencies have A need for forensic services. A Directory entry is made to indicate file name, size, the link to the FAT and other information. The data is written to the Data Area. The File Allocation Table entry for that particular file is zeroed out and shown as available for use by a new file. The first character of the Directory Entry file name is changed to a special character.
Nothing is done to the Data Area.
The data is untouched. The File Allocation Table entry for that particular file is linked to the particular location in the data area where the file data is stored. The first character of the Directory Entry file name is changed to a legal character. Nothing is done to the Data Area. Not Touched As long as the actual data in the Data Area is not overwritten by a new file, deleted files can be recovered.