That's not the case... what happened is they deleted the actual files themselves. On a computer when you delete files they arent really deleted, the bytes are just marked as able to be overwritten, the computer doesn't waste time actually flipping every byte to zero, so it just marks them as 'deleted' and later the computer will overwrite them with other things. By analyzing the raw memory itself you can usually recover these bytes before they've been overwritten. That is what happened, it was deleted, they just failed, forensic harddrive analysis retrieved each byte in the state it was in at the time of deletion.
If you go through the process of deleting electronic information there are various stages of "deleted". When we delete a file the operating system removes the pointers in the file system to that data. As far as the operating system is concerned, that information is no longer linked to the system. The physical hard drive space where that information is stored can now be written to the same as if it were "blank".
Until those physical drive sectors are written to however, they remain in the same state as before. In other words, the information is all there, but the operating system doesn't know about it (directly). You can use a recovery tool to find that information however, since it still exists.
So yes, deleted but recovered.
The only way to truly delete data is to overwrite the physical information with new information. This is beyond the scope of the standard procedure of removal by the operating system.
There are several reasons I can think of why this might not have happened.
They didn't know this (we don't know what level of technical knowledge the people who did the actual deleting had).
They knew this but wanted to be caught (controlled opposition).
They didn't have time (its a much longer process to write over sectors than to just delete pointers)
They never thought it would come to this. This goes along well with (3). It takes a lot more effort (time) than a normal delete, especially across multiple machines. Think about how many there are in the US.
I guess it make a sort of sense when we remember how they recklessly Jerry rigged the steal in the first place out of necessity due to Americans actually liking the America First idea thus voting for it in much larger droves that they had ever imagined. These audits are to depths and scales much larger than they are used to....and....they forget they don't have sole control of information anymore.
Is recovered the right word? Nothing was deleted to begin with, correct?
That's not the case... what happened is they deleted the actual files themselves. On a computer when you delete files they arent really deleted, the bytes are just marked as able to be overwritten, the computer doesn't waste time actually flipping every byte to zero, so it just marks them as 'deleted' and later the computer will overwrite them with other things. By analyzing the raw memory itself you can usually recover these bytes before they've been overwritten. That is what happened, it was deleted, they just failed, forensic harddrive analysis retrieved each byte in the state it was in at the time of deletion.
Honestly that is the same thing the dude above you said but he was a little more "laymen" about it...you are both correct.
lol, yes!
If you go through the process of deleting electronic information there are various stages of "deleted". When we delete a file the operating system removes the pointers in the file system to that data. As far as the operating system is concerned, that information is no longer linked to the system. The physical hard drive space where that information is stored can now be written to the same as if it were "blank".
Until those physical drive sectors are written to however, they remain in the same state as before. In other words, the information is all there, but the operating system doesn't know about it (directly). You can use a recovery tool to find that information however, since it still exists.
So yes, deleted but recovered.
The only way to truly delete data is to overwrite the physical information with new information. This is beyond the scope of the standard procedure of removal by the operating system.
I would think the bad guys would know this.
There are several reasons I can think of why this might not have happened.
I guess it make a sort of sense when we remember how they recklessly Jerry rigged the steal in the first place out of necessity due to Americans actually liking the America First idea thus voting for it in much larger droves that they had ever imagined. These audits are to depths and scales much larger than they are used to....and....they forget they don't have sole control of information anymore.