Guide
Can You Prove Who Deleted A File
17 pages · 23 min read
This guide, 'Can You Prove Who Deleted A File?', addresses the attribution of an absence, specifically file deletion.
- Deleted data and recovery
§ Guide
Can You Prove Who Deleted A File
This guide, 'Can You Prove Who Deleted A File?', addresses the attribution of an absence, specifically file deletion.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 23 min read · Published 2026-08-31
This guide, 'Can You Prove Who Deleted A File?', addresses the attribution of an absence, specifically file deletion. It covers deletion artefacts, audit trails, and the process of attributing deletion from an account or profile to the person at the keyboard. The guide details cloud and server deletion, including audit logs, recycle stages, and admin actions, as well as local deletion, covering recycle bins, file-system journals, and metadata residue. It also examines deliberate erasure using wiping tools and anti-forensics. The guide is relevant for UK lawyers dealing with spoliation, employment, and fraud cases, or when an innocent explanation for deletion is offered. It provides insights into source architecture, common mistakes, technical limitations, and questions to ask, including suggested wording for instruction for deletion attribution.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. See every guide's author and source.
§ Full text of Can You Prove Who Deleted A File
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
Page 1
DELETIONATTRIBUTION · A GUIDE FOR UK LAWYERS Can You Prove Who Deleted a File? Deletion Artefacts, Audit Trails and the Attribution of an Absence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FILE-SYSTEM JOURNAL ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: deletion is an act, and acts have actors 03 Cloud and server deletion: audit logs, recycle stages and admin actions 04 Local deletion: recycle bins, file-system journals and metadata residue 05 Deliberate erasure: wiping tools, anti-forensics and their own artefacts 06 Attribution: from account and profile to the person at the keyboard 07 Deployment: spoliation, employment, fraud and the innocent explanation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DELETIONISRECORDEDBYTHEPLATFORM, THE FILE SYSTEM ANDTHEERASURETOOLITSELF: THERECORDNAMESANACCOUNTORPROFILE, THE CORROBORATIONNAMESTHEPERSON, ANDTHETIMINGAGAINSTTHEDUTYNAMESTHE CONSEQUENCE
§ 02 · FIRST PRINCIPLES The problem in plain English: deletion is an act, and acts have actors
§ 03 · CLOUDANDSERVERDELETION Cloud and server deletion: audit logs, recycle stages and admin actions
Page 2
§ 04 · LOCALDELETION Local deletion: recycle bins, file-system journals and metadata residue
§ 05 · DELIBERATEERASURE Deliberate erasure: wiping tools, anti-forensics and their own artefacts
§ 06 · ATTRIBUTION Attribution: from account and profile to the person at the keyboard
§ 07 · DEPLOYMENT Deployment: spoliation, employment, fraud and the innocent explanation
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION DEVICE TOOL PLATFORM RECYCLE FILE-SYSTEM ESTATE AUDIT LOG STAGES STRUCTURES REDUNDANCY SESSION / ERASURE- LAYER ARTEFACTS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEPURGEAT23: 12ANDTHEACCOUNTTHATDIDIT EXAMPLE2 · THECLEANLAPTOPANDTHECLEANER ' SRECEIPT EXAMPLE3 · THEDELETIONTHATWASAPOLICY, ANDTHEALLEGATIONTHATWAS WITHDRAWN
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORDELETION AT TRIBUTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The deletion-attribution checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions If a file is gone, how can anyone know who deleted it? Does emptying the recycle bin remove the evidence of deletion? The laptop came back wiped. Is there anything to find? Can we prove it was the person and not just their account? Our client did delete the files, but before any dispute. Does that matter? What if the deletion was done by a retention policy or an administrator?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Common questions
Frequently asked questions
- If a file is gone, how can anyone know who deleted it?
- Because deletion writes records the deleter does not see: the platform's audit event naming the account, the recycle bin's metadata naming the profile and time, the file system's journal recording the transaction (§3-§4): Example 1's purge sequence was reconstructed entirely from those. The content's absence and the act's record are separate things.
- Does emptying the recycle bin remove the evidence of deletion?
- It removes the item and, in time, the bin's metadata file: but the emptying is itself an audited or journaled event, the metadata file persists in unallocated space for a period, and the platform's second-stage store holds cloud items longer (§3-§4). Emptying the bin usually adds a second attributed event rather than removing the first.
- The laptop came back wiped. Is there anything to find?
- Often the most important thing: the wiping tool's installation and execution records, its settings, the overwrite pattern and the change journal it did not target (§5, Example 2): deliberate erasure after a duty arose is stronger evidence than the erased files would have been. The device is imaged first and the tool's receipt read second.
- Can we prove it was the person and not just their account?
- To the extent the corroboration allows: session and device from sign-in records, presence from badges or calendar, their own messages about it, and the exclusion of alternatives (shared login, unattended desk, sync, policy) (§6): the report grades the attribution accordingly. "Account X on device Y at 23:12" is a finding; the name follows when the lattice supports it.
- Our client did delete the files, but before any dispute. Does that matter?
- Enormously: deletion before the preservation duty arose is retention or housekeeping, and the attribution record proves the timing (§7, guide 95 §6): Example 3's policy deletions eleven months before contemplation defeated the allegation with costs. Establish the date from the record; it is the whole difference between a gap and spoliation.
- What if the deletion was done by a retention policy or an administrator?
- Then the audit event says so: system identities, policy execution records and admin actions are distinguishable from user deletions by event type and acting account (§3), and the policy's configuration history dates its origin. Attribution to a policy is a finding that exonerates the individual: and, if the policy ran after a hold should have suspended it, a preservation failure of a different kind. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17
§ Related documents
Guide
Android Deleted Data SQLite And Unallocated Space
19 pages · 26 min read
- Mobile and messaging evidence
- Deleted data and recovery
Guide
IOS App Data And Third Party Application Forensics
17 pages · 25 min read
- Deleted data and recovery
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.