Case Study 2 — When "Deleted" Really Meant Gone

The same word — deleted — on a different medium produces the opposite outcome. An SSD's TRIM command turns a routine recovery into an impossibility, and then sets a trap in the courtroom: the examiner who mistakes a drive's normal behavior for a suspect's deliberate wiping. The medium decides what is possible, and the honest finding is sometimes "the data is gone, and I cannot say who deleted it or why."

Background

A mid-size company suspects a departing sales director of taking a confidential client list to a competitor. The director resigned on a Friday; IT collected her company laptop the following Monday. Management's theory is simple: she copied the list, then deleted the evidence to cover her tracks. They engage a forensic examiner with a clear, narrow scope: determine whether the client-list spreadsheet was present on the laptop, whether it was deleted, and whether it can be recovered.

The laptop is a modern ultrabook with a single NVMe SSD, NTFS, full of the usual corporate software. It is, importantly, an SSD — not the spinning disk the engagement's assumptions were quietly built on. The examiner has handled a hundred drives like the wedding-photos case, where a deleted file deleted a week ago is recovered before lunch. The instinct "deleted data persists, so we have time" is the right instinct on a hard drive. It is the wrong instinct here, and the difference is the whole case.

Recovery vs. Forensics. On an HDD, TRIM is irrelevant and the recovery instinct holds. On this SSD, TRIM is the central fact — and it cuts two ways. For 🔍 forensics, TRIM can destroy data beyond reach, and the absence of expected data on a TRIM-enabled SSD must not be misread as a suspect's deliberate wiping. Confusing the medium's normal behavior with anti-forensic activity is exactly how examiners get embarrassed on cross-examination.

The investigation

The examiner does everything right at the front end. The laptop is acquired through proper procedure, imaged, and hashed; all analysis happens on a verified working copy. The acquisition notes the medium correctly:

  Acquisition summary (illustrative)
  source     : NVMe SSD, 512 GB, NTFS, single volume
  sector size: 512 logical / 4096 physical
  TRIM       : supported and ENABLED (default on this OS)
  image      : laptop_case.E01
  sha256     : 2c9a...74bf  (verified after acquisition: match)

Examining the NTFS Master File Table, the examiner finds a residual MFT record for a file named ClientList_2026_Q2.xlsx. The record's "in use" flag (bit 0 at offset 0x16 of the record header) is cleared — the file was deleted — but the record itself survives, carrying the original filename, a logical size of 1,184,256 bytes, and timestamps showing creation months earlier and deletion on the Friday of the resignation. The metadata is a gift: it proves a file by that name existed and was deleted on a meaningful date.

Then the recovery fails. The MFT record's data-run pointers reference clusters out in the volume, and when the examiner reads those clusters from the image, they return all zeros:

   Reading the clusters the deleted MFT record points to:

   0a1c0000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   0a1c0010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   ...                                                  (zeros, continuous)

   Expected (on an HDD): residual .xlsx data -> 50 4B 03 04 (PK..) header.
   Found  (on this SSD): nothing. The pages were physically erased.

This is not corruption and not overwriting by a new file. It is TRIM. When the file was deleted on Friday, the operating system told the SSD controller those logical blocks were no longer needed; garbage collection then physically erased the underlying NAND pages on its own schedule, almost certainly within minutes — long before IT collected the laptop on Monday. A file-carving pass across the unallocated space confirms it: no 50 4B 03 04 Office signature, no spreadsheet fragments, nothing. The same deletion that would have left the file trivially recoverable on a spinning disk left, on this SSD, a perfect field of zeros.

The examiner now faces the part of the job that separates professionals from technicians: what can and cannot be honestly concluded.

What the evidence supports: a file named ClientList_2026_Q2.xlsx, ~1.18 MB, existed on the laptop and was deleted on the Friday of the resignation. The MFT record proves that much.

What the evidence does not support: that the spreadsheet's contents were the confidential client list (the name is suggestive, not proof); that the file was copied to any external device (no such artifact was in scope or found); and — critically — that the deletion was a deliberate act of evidence destruction. On a TRIM-enabled SSD, the zeroing of deleted data is the drive's normal, automatic behavior. It happens identically whether a user empties the Recycle Bin in panic or the operating system tidies up a temp file. The zeros prove the data is gone. They do not prove intent.

Limitation. This is theme five — know your limitations — in its sharpest form. The examiner cannot recover the file (TRIM physically erased it) and cannot, from the storage artifacts alone, prove why it was deleted. "The evidence is insufficient to determine whether the deletion was routine or deliberate" is not a failure; it is the correct, defensible finding.

The report says exactly that. It documents that a file by that name and size was deleted on that date, that the data is unrecoverable because the medium is a TRIM-enabled SSD, and that the storage evidence alone cannot establish intent or prove the contents. Months later, opposing counsel deposes the examiner and pushes hard: Isn't it true the defendant wiped this file to hide it? The examiner holds the line — the zeros are consistent with deliberate deletion and equally consistent with the SSD's normal automatic erasure of any deleted file; the artifact cannot distinguish the two. Had the examiner over-claimed in the report — "the defendant deliberately wiped the evidence" — that single sentence would have unraveled on cross, and with it the examiner's credibility on everything else.

The analysis

  1. The medium decides what is possible. The only thing that changed between "trivially recoverable" (Case Study 1) and "permanently gone" was HDD versus TRIM-enabled SSD. Identify the medium before forming any expectation about recoverability.

  2. TRIM closes the window in minutes, not months. "Deleted data persists, so we have time" is true on magnetic media and dangerously false on a TRIM-enabled SSD. The two-day gap before collection that saved the wedding photos was, here, far more than enough time for the data to be physically erased.

  3. Residual metadata can survive even when the data does not. The MFT record outlived the file's contents, proving the file existed and when it was deleted. Metadata and data have independent lifetimes; do not assume that recovering one means recovering the other.

  4. Absence of data is not proof of wiping. On a TRIM-enabled SSD, automatic zeroing of deleted blocks mimics deliberate anti-forensic erasure. Reading intent into the medium's normal behavior is a classic, credibility-destroying error.

  5. "Insufficient to conclude" is a valid professional finding. Over-claiming to satisfy a client's theory is the fastest route to being discredited. The examiner's careful, bounded language is what survived cross-examination.

Discussion questions

  1. Contrast this case with Case Study 1 point by point: same operating system, same kind of "delete," opposite outcome. List every factor that differed and rank them by how much each one mattered.

  2. The MFT record proved a file named ClientList_2026_Q2.xlsx existed and was deleted on a specific date, but the data was unrecoverable. Draft two sentences for the report: one stating what this does establish and one stating what it does not. Why is the second sentence as important as the first?

  3. Management wanted to hear "she deliberately wiped the evidence." Explain why the examiner's refusal to say so — despite it being what the client paid to hear — is the professionally and ethically correct choice. What pressures push examiners toward over-claiming, and how do you resist them?

  4. ⭐ Suppose TRIM had been disabled on this laptop (a non-default configuration), or the file had lived briefly on an attached non-TRIM USB stick. How would the recovery prospects and the available conclusions change? Use this to explain why "was TRIM active, and how long ago was the deletion?" is the first question on any SSD job. (See Chapter 9 — SSD and Flash Recovery.)

  5. Identify three additional evidence sources outside the storage medium that might have established whether the client list was actually taken (consider USB device history, cloud-upload logs, and email). Why can artifacts elsewhere sometimes answer a question that the deleted file itself — destroyed by TRIM — never can?