Question 1

If a file is gone, how can anyone know who deleted it?

Accepted Answer

Because deletion writes records the deleter does not see: the platform's audit event naming the account, the recycle bin's metadata naming the profile and time, the file system's journal recording the transaction (§3-§4): Example 1's purge sequence was reconstructed entirely from those. The content's absence and the act's record are separate things.

Question 2

Does emptying the recycle bin remove the evidence of deletion?

Accepted Answer

It removes the item and, in time, the bin's metadata file: but the emptying is itself an audited or journaled event, the metadata file persists in unallocated space for a period, and the platform's second-stage store holds cloud items longer (§3-§4). Emptying the bin usually adds a second attributed event rather than removing the first.

Question 3

The laptop came back wiped. Is there anything to find?

Accepted Answer

Often the most important thing: the wiping tool's installation and execution records, its settings, the overwrite pattern and the change journal it did not target (§5, Example 2): deliberate erasure after a duty arose is stronger evidence than the erased files would have been. The device is imaged first and the tool's receipt read second.

Question 4

Can we prove it was the person and not just their account?

Accepted Answer

To the extent the corroboration allows: session and device from sign-in records, presence from badges or calendar, their own messages about it, and the exclusion of alternatives (shared login, unattended desk, sync, policy) (§6): the report grades the attribution accordingly. "Account X on device Y at 23:12" is a finding; the name follows when the lattice supports it.

Question 5

Our client did delete the files, but before any dispute. Does that matter?

Accepted Answer

Enormously: deletion before the preservation duty arose is retention or housekeeping, and the attribution record proves the timing (§7, guide 95 §6): Example 3's policy deletions eleven months before contemplation defeated the allegation with costs. Establish the date from the record; it is the whole difference between a gap and spoliation.

Question 6

What if the deletion was done by a retention policy or an administrator?

Accepted Answer

Then the audit event says so: system identities, policy execution records and admin actions are distinguishable from user deletions by event type and acting account (§3), and the policy's configuration history dates its origin. Attribution to a policy is a finding that exonerates the individual: and, if the policy ran after a hold should have suspended it, a preservation failure of a different kind. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Can You Prove Who Deleted A File