Question 1

Can deleted files really be recovered, and for how long?

Accepted Answer

Often, and it depends: on drive type (hard drives hold released content until overwritten, months or years; SSDs erase it in background housekeeping, days or less), on activity since, and on the parallel routes: Recycle Bin remnants, shadow copies, temporary and cached duplicates, backups. Two honest constants: the metadata layer (that files existed, and when they were deleted) survives far longer than content; and every week of delay closes doors. Instruct early and let the examiner report which doors this particular machine still has open.

Question 2

Can the computer prove who was using it, rather than which account?

Accepted Answer

Not alone, and no honest expert claims it can: the machine proves account sessions. The human layer is built around them: authentication type and credential exclusivity, corroborating records (badges, VPN, CCTV, phones), and in-session behaviour (whose webmail, whose files, whose patterns): usually to a comfortable civil standard, some time s beyond. What decides cases is doing that layer explicitly: Example 3 is what happens when a party skips it, and §5 is the discipline that survives cross-examination.

Question 3

If someone used a wiping tool, is the evidence gone?

Accepted Answer

The targeted content may be; the event rarely is. Wiping tools appear in execution artefacts (Prefetch, User Assist, Amcache) with run times, their acquisition often sits in the browser record, mass deletions leave file- system and journal traces, and configuration changes are logged. Post-duty destruction then does its own damage: adverse inferences, strike-out exposure, and Example 2's outcome: courts treat proven spoliation, provably timed, as loudly as the missing documents would have spoken.

Question 4

The laptop has been used for months since the events. Is exam in at i on point less?

Accepted Answer

No: it re-weights toward the durable layers. Registry device history, LNK and shellbag records, execution artefacts, and event-log reach often survive routine use for long periods; deleted-content recovery and short- horizon artefacts suffer most. The exam in at i on scopes to what the elapsed time left, and the report states horizons honestly: months of use narrows the window, it does not board it up.

Question 5

Does any of this work on a Mac, or on cloud-stored files?

Accepted Answer

The philosophy transfers, the artefacts differ: macOS keeps its own equivalents (covered in the next guide in this series), and files living in cloud tenancies leave their substantive record server-side, where platform audit logs and versions do the work (the cloud guides that follow). The Windows machine remains evidentially rich even in cloud-centric estates: sync clients, local caches and the artefact families above record the local half of every story: but complete answers usually mean collecting both halves.

Question 6

What does a Windows exam in at i on cost and how long does it take?

Accepted Answer

Scoped work on defined questions (a leaver's last month, a USB window, an attribution dispute) is typically days of examiner time on a fixed estimate, after imaging; full-timeline work on multi-year questions scales with the ambition. The economical route is the instruction wording in §13: precise questions, graded findings, stated limits: which buys conclusions rather than tooling output, and usually answers in one report what open-ended "look at everything" instructions answer in three. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 17 of 20

What Evidence Can Be Recovered From A Windows Computer