What is Digital Forensic Data Recovery?

A Defensible Framework for Preserving, Recovering and Interpreting Electronic Evidence

By Navid Sobbi, Founder and CEO, NSI Global

ORIGINAL PUBLICATION: 26 December 2023  REVISED: 1 September 2026 (AEST)

This paper provides general technical and risk-management information. It is not legal advice and does not guarantee that particular data can be recovered or admitted as evidence.

Table of Contents

This white paper follows the recovery lifecycle from preservation and acquisition through to interpretation, reporting and commissioning decisions.

• Executive Summary
• Purpose, Scope and Terminology

1. Data Recovery and Digital Forensics Are Not the Same
2. The Recovery Problem Starts Before Examination
3. What Can Be Recovered – and From Where
4. A Defensible Forensic Recovery Framework
5. Why Recovery May Be Limited or Impossible
6. From Recovered Data to Reliable Evidence
7. Legal, Privacy and Proportionality Considerations
8. Commissioning the Right Scope
9. Questions Decision-Makers Should Ask

• In Sum
• Frequently Asked Questions
• Sources and Further Reading

Executive Summary

Digital forensic data recovery is the controlled process of preserving a digital source, acquiring data through an appropriate forensic method, recovering information that is deleted, damaged, concealed or otherwise inaccessible, and interpreting the result in its technical context. Its purpose is not simply to make a file visible again. It is to establish what was recovered, where it came from, how it was obtained, what changed during the process and what conclusions the data can reliably support.

That distinction matters whenever the outcome may influence litigation, an internal investigation, an insurance decision, a regulatory response, an employment process or a cyber incident. Ordinary recovery software is designed to restore access. A forensic process must also protect integrity, preserve provenance, maintain an audit trail and explain limitations.

The recovery opportunity can diminish quickly. Continued use of a computer may overwrite unallocated space. A solid-state drive may process deletion commands through TRIM and garbage collection. A mobile phone may lock, synchronise, update or remotely receive commands. Cloud retention periods may expire. An application may rotate logs or replace local databases. Even well-intentioned actions – restarting a device, installing software, opening files or reconnecting it to a network – can alter evidence or remove the best available recovery pathway.

Forensic recovery therefore begins with decisions, not tools. The examiner must understand the issue under investigation, the lawful authority, the relevant devices and accounts, the volatility of each source, and the consequences of delay. The acquisition method should follow the source and the evidentiary objective rather than a promise to “recover everything”.

This white paper is guided by seven overarching forensic principles, which operate across NSI Global’s nine-stage DFIR-EDM:

1. Preserve first and examine a controlled copy wherever the source permits
2. Match the acquisition method to the device, operating state, storage technology and investigative question
3. Use validated methods and document the tools, settings, exceptions and examiner actions
4. Treat recovered content, metadata and system artefacts as different forms of evidence
5. Corroborate important conclusions across independent sources where possible
6. State technical limitations and uncertainty instead of converting partial recovery into certainty
7. Define a scope broad enough to address the risk, but proportionate to lawful authority and relevance

The central conclusion is simple: a recovered file becomes useful evidence only when its origin, integrity, context and limitations can be explained.

Purpose, Scope and Terminology

This paper is intended for legal counsel, boards, corporate investigators, insurers, risk leaders, incident responders and IT teams who commission, supervise or rely on digital forensic recovery.

In this paper, source evidence means the original device, account, storage medium or system from which data is acquired. A forensic image is a controlled representation of a source created for examination; depending on the source and method, it may be a bit-stream image, file-system acquisition, logical extraction, targeted collection or another documented forensic capture. A hash value is a cryptographic digest used to compare data at different stages. Matching hashes can demonstrate that two captured datasets are identical at the byte level, but a hash alone does not prove that the original source was complete, authentic or lawfully obtained.

Recovery means making data or artefacts accessible for examination. Interpretation means analysing how those artefacts were created and what they may indicate. Admissibility is a legal question determined under the applicable rules and circumstances; no tool, certificate or chain-of-custody form automatically makes evidence admissible.

1. Data Recovery and Digital Forensics Are Not the Same

Conventional data recovery usually serves an operational goal: restore files, make a failed drive readable or return a system to service. Success is commonly measured by how much usable content becomes available.

Digital forensic recovery serves an investigative goal. The examiner may need to recover deleted content, but must also preserve timestamps, file-system structures, database relationships, application records and other artefacts that explain where the content originated and how it relates to events. The most important result may not be a restored document. It may be evidence that a file existed, that an account accessed it, that a USB device was connected, that a message database changed, or that a deletion event occurred within a particular sequence.

ISO/IEC 27037 addresses identification, collection, acquisition and preservation as distinct activities in handling potential digital evidence. SWGDE likewise separates collection, acquisition, examination and reporting. The separation is practical: a technically successful extraction does not answer whether the right source was collected, whether the method was appropriate, or whether the interpretation is sound.

2. The Recovery Problem Starts Before Examination

The earliest decisions often determine the recovery ceiling. Once deleted information has been overwritten, encryption keys have been lost or cloud records have expired, later use of more sophisticated tools may not reverse the loss.

2.1 Continued Use Can Change the Evidence

Operating systems continually write data. They create logs, caches, thumbnails, search indexes, temporary files, update records and application databases. Installing a recovery program on the device being examined is especially risky because the installation and subsequent scans may write into space that previously contained deleted content.

The correct first action depends on the source. A powered-off storage device may usually remain off until a forensic plan is made. A running server, encrypted computer or unlocked mobile device may contain volatile access that will disappear if power is removed. A live acquisition can itself create or alter artefacts; SWGDE guidance recognises this and requires the least invasive available method and documentation of changes. “Never switch it off” and “always switch it off” are therefore both unsafe universal rules.

2.2 Connectivity Can Create New Risk

A connected mobile device or computer may receive synchronisation traffic, remote-management commands, security updates or deletion instructions. Isolation may be necessary, but the examiner must consider whether network separation could trigger an application response, interrupt a needed cloud session or prevent access to remotely stored content.

2.3 Preservation Must Follow the Whole Evidence Environment

Relevant evidence may exist beyond the obvious device. A missing email can be represented in a mail server, recipient mailbox, mobile cache, backup, security log or collaboration platform. A deleted document may survive in version history, endpoint telemetry, cloud synchronisation records, print artefacts or another custodian’s device. Early preservation should therefore map people, accounts, devices, applications, cloud providers and retention periods before narrowing the examination.

The Australian Signals Directorate advises organisations to plan for the collection, preservation, handling and storage of evidence during incident response. That principle also applies to litigation and internal investigations: preservation should be designed before routine business processes erase or replace relevant data.

3. What Can Be Recovered – and From Where

Recovery depends on the source, its physical condition, operating system, encryption state, application design, storage technology and the time since deletion or damage. No responsible examiner can determine recoverability from the file name alone.

3.1 Computers, Hard Drives and External Storage

Computer examinations may identify active files, deleted directory entries, file-system journals, previous versions, link files, thumbnails, browser artefacts, USB history, event records and data fragments in unallocated space. File carving can identify content from characteristic headers and structures when directory information is missing, but carved files may lack original names, paths or reliable timestamps.

Traditional magnetic hard drives may retain deleted sectors until they are reused. Solid-state drives behave differently. TRIM can tell the device that blocks are no longer required, and internal garbage-collection processes may erase or reorganise them. Wear levelling and controller behaviour can also make the physical relationship between logical addresses and flash cells inaccessible to standard acquisition methods. This means a recently deleted SSD file can sometimes be less recoverable than an older deletion on a magnetic drive.

3.2 Mobile Phones and Tablets

Modern mobile devices combine strong encryption, secure hardware, application sandboxes and rapid software change. Available acquisition levels can range from backup or logical extraction to file-system or lower-level access, depending on the model, operating-system version, security state and lawful authority.

Deleted messages are not necessarily stored as intact records. Portions may remain in database free pages, write-ahead logs, notification records, attachments, cloud synchronisation data or another participant’s device. Conversely, an application interface may show a message that is not retained in the local database. Mobile recovery should distinguish what the device displayed from what the acquisition actually captured.

3.3 Cloud, Email and Collaboration Platforms

Cloud evidence is governed by provider architecture and retention rather than by a local disk alone. Potential sources include mailbox data, audit logs, account sign-ins, version histories, deleted-item retention, administrator events, shared links and third-party integrations. Collection may require preservation through an administrator, legal process, provider export, application programming interface or documented manual capture.

The dataset produced by a provider may omit information visible through a different interface or subscription tier. Time zones, export transformations and provider-generated fields must be understood before building a timeline. SWGDE’s cloud guidance emphasises acquisition, preservation and analysis as source-specific tasks.

3.4 Damaged, Corrupted or Failed Media

Logical damage and physical damage require different capabilities. Logical recovery addresses readable media affected by deletion, formatting, file-system corruption or inaccessible structures. Physical recovery may require clean-room or specialist hardware work where heads, motors, circuit boards, memory components or controllers have failed.

A forensic provider should state whether physical work is performed in-house, through a specialist laboratory or outside the commissioned service. Repair attempts can change the source, so the handover, intervention and resulting evidence should be documented if the recovered data may later be relied upon.

3.5 Vehicles, Wearables, Cameras and Connected Devices

Potential evidence may also be stored in vehicle infotainment systems, navigation histories, wearable devices, cameras, drones, access-control systems, Internet of Things devices and their companion cloud accounts. These sources may record location, pairing, timestamps, sensor events or user interaction, but their clocks and retention behaviour may not be reliable without validation.

4. A Defensible Forensic Recovery Framework

NSI Global applies its Nine Stage Digital Forensic Incident Response Electronic Discovery Model (DFIR-EDM) to govern authorised matters from instruction through to reporting. The model connects legal authority, evidence handling, technical examination and eventual use. It is iterative rather than a rigid waterfall: a finding during analysis may require further preservation or collection, while review may identify a need to refine the scope.

The depth of work at each stage depends on the source, risk, lawful authority and decision the evidence must support. Applying nine named stages does not imply that every engagement requires the collection or examination of every available source.

Stage 1: Legal Notices and Authority

Establish the instruction, allegation or event to be examined, the decision the work must inform and the lawful basis for access. Identify ownership and control of devices, accounts and systems; relevant legal holds, court orders and preservation notices; privilege arrangements; privacy constraints; jurisdictional issues; and authorised workstreams. A direction to “recover everything” is not a sufficient substitute for a defined and proportionate mandate.

Stage 2: Chain of Custody

Make possession, transfer and handling traceable from first receipt. Record source identifiers, condition, time, location, custodian, power and access state, each transfer, storage location and every authorised handler. Chain of custody is not merely a form completed at collection; it continues through acquisition, examination, production and return or disposal.

Stage 3: Preservation

Protect relevant sources from avoidable loss or alteration. Map devices, custodians, accounts, applications, servers, cloud services, backups and third parties, then rank them by volatility, business impact, access state, retention deadline and evidentiary value. Issue appropriate preservation instructions and control device use, connectivity, automated cleanup, account changes and system updates where lawful and necessary.

Stage 4: Collection

Acquire material using methods appropriate to the source, its operating state and the investigative question. Collection may be physical, bit-stream, file-system, logical, targeted, live, remote or provider-assisted. Document the tools and versions, settings, start and finish times, errors, exceptions and examiner actions. Use write protection and cryptographic hashes where applicable; where a live or logical method necessarily changes the system, identify those changes rather than claiming the source remained untouched.

Stage 5: Processing

Prepare acquired material for examination without losing provenance. Preserve the authoritative acquisition and work from a verified controlled copy where practicable. Processing may include extraction, indexing, de-duplication, file-type identification, time normalisation, database parsing, recovery of deleted content and conversion into reviewable forms. Record any transformation so the relationship between the processed item and its source can be explained.

Stage 6: Analysis

Test the questions under investigation against the recovered content, metadata and system artefacts. Methods may include deleted-entry analysis, database examination, log correlation, file carving, reconstruction of fragmented data, metadata assessment, repair of corrupted structures, lawful decryption and comparison with backups or cloud records. Important results should be validated through a second method, known data, tool verification or an independent source where proportionate.

Stage 7: Review

Review material for relevance, quality, privilege, privacy, proportionality and interpretive accuracy. Separate observed data from examiner inference, identify contradictory or missing evidence and assess whether the available scope supports the conclusion. Legal counsel or another authorised reviewer may need to make privilege, disclosure and production decisions that sit outside the examiner’s technical role.

Stage 8: Production

Provide authorised material in the agreed, usable form while maintaining its connection to the source. Production may include native files, forensic exports, review sets, chronologies, schedules, exhibits or other matter-specific outputs. Apply agreed redactions, access controls and transfer protections, and record what was included, withheld, transformed or unable to be produced.

Stage 9: Reporting

Explain the instructions, authority, sources, chain of custody, preservation and collection decisions, processing and analysis performed, material findings, confidence, limitations and any technical opinion. The report should allow the reader to distinguish observed data from inference and understand what the evidence can and cannot support. Reporting may also identify further work required where the commissioned scope leaves a material question unresolved.

5. Why Recovery May Be Limited or Impossible

Deleted does not mean recoverable, and inaccessible does not mean permanently lost. The answer depends on the mechanism that removed access and what happened afterwards.

Recovery percentages should be treated cautiously. A statement that “90 per cent of files” were recovered says little if the missing ten per cent contains the relevant period, if the recovered files have no provenance, or if the original population is unknown.

6. From Recovered Data to Reliable Evidence

Technical recovery answers whether data can be located or reconstructed. Evidentiary reliability requires additional questions.

Provenance

Where did the artefact come from? Record the source device or account, acquisition identifier, path, database table, offset or export location. Screenshots and exported documents can be useful, but they may omit the underlying structures needed to test provenance.

Integrity

Was the acquired dataset preserved consistently through examination? Hashes, write protection, controlled copies and access records assist with this question. Integrity controls should cover transformations as well as the initial collection.

Context

What created the artefact, and how should it be interpreted? A timestamp may represent creation, modification, synchronisation, server processing or display conversion. A contact name may be user-assigned rather than verified identity. A deleted database row may not establish who deleted it or why.

Attribution

Does the evidence identify a person, an account, a device or only an event? Possession of a device, knowledge of credentials and surrounding activity may be relevant, but a technical artefact seldom proves human authorship by itself.

Completeness

What relevant sources were unavailable, excluded or not retained? A report should not present a partial dataset as the complete history. Gaps can be material even when every available file was processed correctly.

Repeatability and Explanation

Could another competent examiner understand the steps, reproduce material results where the source permits, and test the interpretation? A defensible report explains both method and reasoning in language that legal and business decision-makers can follow.

NSI Global’s digital forensic services combine evidence preservation, acquisition, recovery, analysis and reporting for authorised matters. Where opinion evidence is required, the examiner’s duty is independent: NSI Global’s expert witness service is framed around assisting the court rather than advocating for the retaining party.

7. Legal, Privacy and Proportionality Considerations

Digital forensic work must have a lawful and authorised basis. Ownership of a device does not automatically resolve every question about employee communications, third-party data, privileged material, personal information or cloud accounts. Legal counsel should define authority and restrictions where the position is uncertain.

In Australia, evidentiary treatment depends on the applicable jurisdiction, proceeding and purpose. The Evidence Act 1995 (Cth) includes provisions relevant to expert opinion and evidence produced by processes, machines and other devices, but compliance with a forensic process does not itself determine admissibility. State and territory legislation, court rules and expert codes may also apply.

Privacy and proportionality matter even when acquisition is authorised. A mobile device or mailbox can contain extensive information unrelated to the issue. Scope controls may include date ranges, custodians, applications, search terms, data classes, privilege protocols, segregated review and staged escalation. These controls should be designed before broad data is distributed to investigators or decision-makers.

For litigation and large corporate matters, advanced electronic discovery may follow forensic acquisition. The functions should remain distinct: forensics preserves and interprets source evidence, while eDiscovery supports the review and production of relevant electronically stored information.

8. Commissioning the Right Scope

An effective scope is broad enough to address the risk profile and narrow enough to remain lawful, proportionate and technically achievable. It should not be limited to the first device named in an allegation if the relevant activity crosses accounts, cloud services or other custodians. Equally, commissioning every possible source without a decision framework can increase cost, privacy exposure and review burden without improving the answer.

The commissioning brief should define:

1. The questions the investigation or proceeding must answer
2. Relevant dates, people, systems, accounts and locations
3. The suspected conduct and alternative explanations to be tested
4. Sources known to exist and sources that may be volatile
5. Authority, consent, legal hold, privilege and privacy constraints
6. Whether recovery, attribution, timeline reconstruction or expert opinion is required
7. Time-critical access states, provider retention periods and operational constraints
8. Expected reporting format, decision deadlines and potential court use
9. Criteria for expanding, narrowing or stopping the work

A staged scope is often most defensible. Phase one can preserve volatile sources and test whether material evidence exists. Phase two can expand into selected devices, accounts or counterpart sources based on the first findings. Phase three may address expert reporting, rebuttal analysis or production. The stages should not be used to defer urgent preservation.

A Board and Legal-Counsel Commissioning Checklist

1. Define the decision. State what finding or business decision the examination must inform.
2. Confirm authority. Record who can authorise access to each device, account and third-party dataset.
3. Identify volatile sources. Prioritise unlocked, running, cloud-retained or rapidly changing evidence.
4. Protect routine deletion. Suspend relevant recycling, retention and disposal processes where lawfully required.
5. Separate IT remediation from forensic preservation. Coordinate containment so logs and artefacts are not destroyed unnecessarily.
6. Set relevance and privacy boundaries. Define dates, custodians, applications, privilege handling and escalation rules.
7. Specify the required evidentiary standard. Decide whether the result is for internal intelligence, disciplinary action, insurance, litigation or expert evidence.
8. Require limitations to be reported. Do not accept an extraction summary that omits failed sources, inaccessible areas or assumptions.

9. Questions Decision-Makers Should Ask

1. What is the exact source of each material artefact?
2. Was the original source preserved, and what acquisition method was used?
3. Did the process require live access, and what changes did that access create?
4. Which storage areas, applications, accounts or dates were outside the acquisition?
5. Were tools and procedures tested or validated for the function performed?
6. Can the important result be corroborated from another source?
7. Are timestamps normalised and explained rather than merely displayed?
8. Does the report separate fact, inference and expert opinion?
9. What data could not be recovered, and why?
10. Were privacy, privilege and irrelevant personal data managed appropriately?
11. Could another competent examiner understand and test the material steps?
12. Is the examiner qualified to explain the method and withstand independent scrutiny?

In Sum

Digital forensic data recovery is not a more powerful version of consumer file-recovery software. It is an evidentiary process that begins with preservation and authority, continues through source-specific acquisition and reconstruction, and ends with transparent interpretation and reporting.

The most important discipline is restraint. A responsible examiner does not promise complete recovery, treat tool output as unquestionable or infer human conduct from a technical artefact without context. The examiner preserves what remains, documents what changes, tests material findings and explains what the evidence cannot establish.

Organisations that wait until after a device has been reused, a mailbox has been recycled or a cloud log has expired may lose the evidence before the forensic engagement begins. Early advice can protect the recovery opportunity and define a proportionate scope before investigative activity creates new risk.

For an authorised assessment of devices, accounts and potential recovery pathways, contact NSI Global.

Frequently Asked Questions

What is Digital Forensic Data Recovery?

Digital forensic data recovery is the controlled preservation, acquisition, recovery and interpretation of deleted, damaged, concealed or inaccessible electronic information. Unlike ordinary recovery, it also documents provenance, integrity, examiner actions and limitations so the result can be assessed independently.

Can Permanently Deleted Data Be Recovered?

Sometimes. Recoverability depends on whether the underlying data still exists, whether it has been overwritten or erased, the storage technology, encryption, application design and elapsed activity. “Permanently deleted” is an interface description, not a technical diagnosis.

Can Deleted Text Messages Be Recovered?

Possibly, but not in every case. Relevant content may remain in application databases, logs, notifications, attachments, backups, cloud records or another participant’s device. Modern encryption and database cleanup can make deleted content unavailable.

Why Should I Stop Using the Device?

Continued use can create new files and database activity that overwrite or replace recoverable information. The correct handling depends on whether the device is powered, encrypted, unlocked, damaged or connected, so obtain forensic advice before changing its state.

Does a Forensic Image Copy Everything?

Not necessarily. A bit-stream image of accessible storage may capture allocated and unallocated sectors, while logical, file-system, cloud and mobile acquisitions capture different datasets. The examiner should describe precisely what the selected method included and excluded.

Does a Matching Hash Prove the Evidence Is Authentic?

No. A matching hash demonstrates byte-level consistency between compared datasets. It does not by itself prove the original source, identity of the user, completeness of the acquisition or correctness of the interpretation.

Is Recovered Data Automatically Admissible in Court?

No. Admissibility and weight depend on the applicable law, purpose, method, provenance, authenticity, expert evidence and circumstances. Forensic handling supports reliability but does not guarantee a legal outcome.

How Quickly Should a Forensic Examiner Be Engaged?

As early as practicable when evidence may be volatile, a device is unlocked, a system is running, cloud retention is short or continued business use may change data. Early engagement does not always mean immediate full examination; it may begin with preservation and scoping.

What Should a Digital Forensic Recovery Report Contain?

It should identify the instructions, sources, authority, acquisition methods, tools and versions, integrity controls, examination performed, findings, limitations and any opinion. Material assumptions and failed or inaccessible sources should be disclosed.

Sources and Further Reading

1. Australian Signals Directorate: Cyber security incident response planning – evidence collection and preservation
2. ISO/IEC 27037:2012: Identification, collection, acquisition and preservation of digital evidence
3. SWGDE: Best Practices for Digital Evidence Collection
4. SWGDE: Best Practices for Computer Forensic Acquisitions
5. SWGDE: Best Practices for Computer Forensic Examinations
6. SWGDE: Best Practices for Mobile Device Evidence Collection, Preservation, Handling and Acquisition
7. SWGDE: Best Practices for Digital Evidence Acquisition, Preservation and Analysis from Cloud Service Providers
8. SWGDE: Requirements for Report Writing in Digital and Multimedia Forensics
9. NIST: Computer Forensics Tool Testing Program – disk imaging and deleted-file recovery
10. Evidence Act 1995 (Cth)
11. Privacy Act 1988 (Cth)