electronic evidence recovery expert witness Steven G. Burgess writes on: The Case for Electronic Discovery:
Nearly all documents created in offices these days begin their lives on a computer, as a computer file. Computer files are quite dynamic in nature. They change over time as they are accessed. Computer files are not immortal, but the act of deleting a file does not destroy it. Nonetheless, the very act of using a computer overwrites computer files. This document describes how documents are created, what happens to them after their creation or attempted destruction, and explains the following important points:
* Documents when deleted are not necessarily destroyed, and as such, may be recoverable by a professional computer forensics examiner.
* Files retrieved by commercially available data recovery programs are not likely to include all relevant documents or information.
* Continued use of a computer after file deletion may cause the destruction of previously deleted files or documents: Time is of the essence.
* Copying of computer media can be performed without disrupting the data on the computer.