Filesystem artifacts, deleted entries, and allocation state

Mechanism

Filesystem metadata connects names, timestamps, permissions, and allocation records to stored bytes. Deleted files may retain directory entries or data blocks until overwritten. Recovery depends on filesystem design, journaling, fragmentation, discard behavior, and the acquisition method; deletion is not equivalent to immediate erasure.

Practical method

Identify partitions and filesystem types before mounting. Prefer read-only parsing and record inode or file-record identifiers. Compare live directory entries with deleted records and unallocated space. For a recovered file, document whether metadata and contents came from the same allocation record.

partition -> filesystem -> file record -> extents -> recovered bytes
                         metadata may survive separately from data

Interpreting evidence

A recovered filename does not guarantee its old contents remain. Check extent allocation and file structure. Timeline conclusions should account for separate creation, modification, access, and metadata-change semantics.

Pitfalls and limits

Read-write mounts can alter evidence. TRIM and encryption can make recovery impossible. Reused records or blocks may combine old metadata with new content, requiring careful provenance.