The Importance of Demystifying Deleted Data During Cyber Incident Response, Investigations, or E-discovery

When a file is deleted, is it really gone for good? Most people likely think so. Digital forensics experts, however, know that ‘delete’ isn’t necessarily synonymous with ‘disappear,’ which can be an important distinction when investigating an incident or compliance issue. A common denominator between these types of matters in both cybersecurity incident response (IR) and e-discovery is that practitioners are often tasked with finding obscure yet critical electronic evidence –and must often recover data that has been deleted. Most rely on standard processes for doing so, and though these common methods have their merits, intensifying demands and challenges in investigations have created a need for new approaches that provide more robust and efficient routes to the restoration of evidence.

Read more