What Evidence Can Be Recovered From A Windows Computer (1)

Frequently asked questions

Can deleted files really be recovered, and for how long?

Often, and it depends: on drive type (hard drives hold released content until overwritten, months or years; SSDs erase it in background housekeeping, days or less), on activity since, and on the parallel routes: Recycle Bin remnants, shadow copies, temporary and cached duplicates, backups. Two honest constants: the metadata layer (that files existed, and when they were deleted) survives far longer than content; and every week of delay closes doors. Instruct early and let the examiner report which doors this particular machine still has open.

Can the computer prove who was using it, rather than which account?

Not alone, and no honest expert claims it can: the machine proves account sessions. The human layer is built around them: authentication type and credential exclusivity, corroborating records (badges, VPN, CCTV, phones), and in-session behaviour (whose webmail, whose files, whose patterns): usually to a comfortable civil standard, some time s beyond. What decides cases is doing that layer explicitly: Example 3 is what happens when a party skips it, and §5 is the discipline that survives cross-examination.

If someone used a wiping tool, is the evidence gone?

The targeted content may be; the event rarely is. Wiping tools appear in execution artefacts (Prefetch, User Assist, Amcache) with run times, their acquisition often sits in the browser record, mass deletions leave file- system and journal traces, and configuration changes are logged. Post-duty destruction then does its own damage: adverse inferences, strike-out exposure, and Example 2's outcome: courts treat proven spoliation, provably timed, as loudly as the missing documents would have spoken.

The laptop has been used for months since the events. Is exam in at i on point less?

No: it re-weights toward the durable layers. Registry device history, LNK and shellbag records, execution artefacts, and event-log reach often survive routine use for long periods; deleted-content recovery and short- horizon artefacts suffer most. The exam in at i on scopes to what the elapsed time left, and the report states horizons honestly: months of use narrows the window, it does not board it up.

Does any of this work on a Mac, or on cloud-stored files?

The philosophy transfers, the artefacts differ: macOS keeps its own equivalents (covered in the next guide in this series), and files living in cloud tenancies leave their substantive record server-side, where platform audit logs and versions do the work (the cloud guides that follow). The Windows machine remains evidentially rich even in cloud-centric estates: sync clients, local caches and the artefact families above record the local half of every story: but complete answers usually mean collecting both halves.

What does a Windows exam in at i on cost and how long does it take?

Scoped work on defined questions (a leaver's last month, a USB window, an attribution dispute) is typically days of examiner time on a fixed estimate, after imaging; full-timeline work on multi-year questions scales with the ambition. The economical route is the instruction wording in §13: precise questions, graded findings, stated limits: which buys conclusions rather than tooling output, and usually answers in one report what open-ended "look at everything" instructions answer in three. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 17 of 20