The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

In the digital world, every document, image, video, or program we create leaves a trail. Understanding the lifecycle of a file, from its creation to deletion, is crucial for various purposes, including data security, data recovery, and digital forensics. This article delves into the journey a file takes within a storage device, explaining its creation, storage, access, and potential deletion phases.

File Lifecycle

1. Creation: Birth of a Digital Entity

A file’s life begins with its creation. This can happen in various ways:

Software Applications: When you create a new document in a word processor, edit an image in a photo editing software, or record a video, the application allocates space on the storage device and writes the data associated with the file.

Downloads: Downloading a file from the internet involves copying data from the remote server to your storage device.

Data Transfers: Copying a file from one location to another on the same device or transferring it to a different device creates a new instance of the file.

System Processes: Operating systems and applications sometimes create temporary files during various processes. These files may be automatically deleted upon task completion.

During creation, the operating system assigns a unique identifier (often a filename) to the file and stores it in a directory (folder) along with additional information about the file, known as metadata. This metadata typically includes:

File size: The total amount of storage space occupied by the file.

Creation date and time: The timestamp of when the file was first created.

Modification date and time: The timestamp of the last time the file content was modified.

File access permissions: Restrictions on who can read, write, or execute the file.

File type: Information about the type of file (e.g., .docx, .jpg, .exe).

2. Storage: Finding a Home

Storage devices like hard disk drives (HDDs), solid-state drives (SSDs), and flash drives hold the data associated with files. However, the data isn’t stored as a continuous stream of information. Instead, it’s broken down into smaller chunks called sectors.

When a file is created, the operating system allocates a specific number of sectors on the storage device to hold the file content. This allocation process can happen in various ways depending on the file system used.

Here are some key points to remember about file storage:

Fragmentation: Over time, as files are created, deleted, and resized, the available sectors become fragmented across the storage device. This fragmentation can impact file access speed.

File Allocation Table (FAT) or Similar Structures: Some file systems rely on a separate table (FAT) or index that keeps track of which sectors belong to specific files.

Deleted Files: When a file is deleted, the operating system typically only removes the reference to the file from the directory structure. The actual data may still reside on the storage device until overwritten by new data.

3. Access: Reading and Writing

We interact with files by accessing them for various purposes, such as reading a document, editing an image, or running a program. This involves the following steps:

File System Request: When an application attempts to access a file, it sends a request to the operating system.

Directory Lookup: The operating system first locates the file’s entry in the directory structure.

Allocation Table or Index Lookup: Depending on the file system, the operating system might consult the FAT or similar structure to determine the physical location of the file data on the storage device.

Data Retrieval: The operating system retrieves the data from the allocated sectors and presents it to the application.

File Modification: If the application attempts to modify the file content, the operating system needs to find new sectors to store the updated data. This process can involve overwriting existing data or allocating new sectors depending on the available space.

4. Deletion: Erasing the Footprint (or Not Quite)

When a file is deleted using the operating system’s delete function, the process primarily involves removing the file’s entry from the directory structure. As mentioned earlier, the actual data may still reside on the storage device until overwritten.

Here’s why deleted files aren’t truly gone:

Overwriting: Until new data is written over the sectors holding the deleted file’s content, it remains recoverable using data recovery software. This depends on factors like the type of storage device and how actively it’s used.

Unallocated Space: The deleted file’s sectors are simply marked as “unallocated,” indicating the operating system can utilize them for new data storage.

Different File Systems:

File systems provide the fundamental structure for storing and organizing files on a storage device. They dictate how files are created, stored, and accessed. From a digital forensics perspective, understanding different file systems is crucial for effective evidence recovery and analysis. Here’s a breakdown of the most common file systems and the considerations for investigators:

1. FAT (File Allocation Table) Systems

Legacy Systems: Found on older storage devices like floppy disks, USB drives, and some early hard drives.

FAT Table: Relies on a master table (FAT) that tracks the allocation of data within clusters (groups of sectors) on the storage device.

Forensics Advantages: Relatively simple structure, easier to analyze.

Challenges: Limited file size support in older versions, prone to fragmentation, potential for data overwriting after deletion.

2. NTFS (New Technology File System)

Modern Windows Systems: The default file system of modern Windows operating systems.

Master File Table (MFT): A comprehensive database tracking all files and folders on the volume, including detailed metadata.

Forensics Advantages: Journaling for data integrity, better file security, support for larger files and volumes, potential for deleted file recovery.

Challenges: Increased complexity compared to FAT, potential for recovery hinderance due to overwriting.

3. Ext (Extended File System) Family

Linux Systems: Popular file system for Linux distributions. Includes several versions (Ext2, Ext3, Ext4).

Inodes: Uses a data structure called “inodes” that store detailed metadata and track file allocation on the storage device.

Forensics Advantages: Journaling (in later versions) for data integrity, support for large files and volumes.

Challenges: Increased complexity compared to FAT or older NTFS versions; recovery tools may need to be Linux-compatible.

4. HFS+ (Hierarchical File System Plus)

Mac Systems: Used in older macOS systems.

B-trees: Employs B-trees (data structures for organizing information) for file organization.

Forensics Advantages: Journaling (optional), support for large files and volumes.

Challenges: Primarily used in macOS systems, potentially requiring specialized forensics tools for analysis.

5. APFS (Apple File System)

Modern Mac Systems: The default option on modern macOS, iOS, watchOS, and tvOS systems.

Copy-on-Write: Employs a copy-on-write mechanism for data modifications, preserving original file versions.

Forensics Advantages: Optimized for SSDs, encryption features.

Challenges: Increased complexity, nascent forensics tools due to relative novelty of the file system.

Post-deletion, the fate of files varies across file systems:

In FAT, deleted files are marked as available for reuse, with their data potentially recoverable until overwritten.

NTFS may overwrite deleted files’ clusters, hindering recovery, but some residual data may remain.

Ext file systems may retain deleted file data until overwritten, facilitating recovery from unallocated space.

HFS+ and APFS utilize journaling, potentially overwriting deleted file data rapidly but still leaving chances for recovery until overwritten.

Conclusion

Having a deep understanding of file lifecycles, file systems, and the storage of deleted files is indispensable in digital forensics. Mastery of these concepts equips forensic investigators to reconstruct events, extract evidence, and unravel complex data structures crucial for legal proceedings and incident response in the digital realm. By leveraging specialized tools and techniques, forensic analysts can navigate diverse file systems, recover deleted artifacts, and elucidate the digital footprint left behind in storage devices.