When using a computer many people think that the files they delete have disappeared indefinitely. However, when there is the need for files to be found, (say, as part of a criminal or disciplinary investigation) a computer forensic analyst knows just how to find them.

The average user cannot see the potential evidence that is kept in computer files and therefore believe that by simply pressing ‘Delete’ the files are then erased. Providing these files have then not been overwritten by regular and sustained use of a computer, they can be relocated in the "non live" areas on the hard disk. These are called unallocated clusters and can hold gigabytes of deleted data.

Computer analysis should be carried out by highly skilled and approved practitioners who understand the science behind recovering these potentially valuable files, which can be used as vital evidence within a court case. Forensic analysts use their expertise and specialist software to recover data that can hold a lot of information unbeknown to the user.

Depending on what information still remains on the computer, the forensic analysts can find a lot of valuable information about its background. For example they may be able to tell under what log in name the files were deleted as well as the date and time that the deletion occurred. Many people also try to disguise criminal data under different file names and extensions. Forensic analysis tools can make this apparent and the analyst can see those harmful files being disguised as something else.

Passwords may not be much to keep out a forensic analyst - and depending on the level of encryption - many forensics analysts have tools that can find ways into files that contain vital data.

Files that have become corrupted or partly erased can also be partially retrieved. Depending on the level of corruption, files can be traced and used as potential evidence against a suspect.

The process of computer analysis takes time and patience. Specialized forensic analysts can investigate whether anything that has been inputted or downloaded on to the computer. They have the tools to see everything on the hard drive regardless of whether it has been deleted or corrupted.