Do the Maricopa auditors already have the missing files? Screenshot they posted was from data recovery software.
(media.greatawakening.win)
?? Theory ??
You're viewing a single comment thread. View all comments, or full comment thread.
Comments (67)
sorted by:
In most operating systems, deleting a file means removing the record entry that points to where the file content is stored. The data isn't really "wiped" per se, but the storage clusters holding the data is marked free for use.
The discovery of those missing entry by a forensics program shows that they were able to discover the deletion. Furthermore, they definitely can recover it... But there's no guarantee the contents arent corrupted.
One more thing to add is that modern hard drives make use of redundant writes onto multiple platters to speed up the disk I/O. So, having the file corrupted on one cluster means it can be still restored from another cluster.
As someone points out, only way for true deletion is if they did multiple writes over the sector containing the data bytes. But given that the county didn't have much time nor expertise, i'm guessing they just dragged the files into the recycle bin and emptied it.