What Do I Do if Everything on A Device Is Deleted?

What do you do if something is wiped off a device?

A lot of times employees,. will ctrl-alt-delete everything before they walk out of a workplace. Other times, they just wipe a personal device clean because they want to have closure regarding a former employer.  Most of the time and with most equipment, most phones, most laptops, most desktops, forensic credentialed folks can get all that data for you, including the delete activity.

Forensically credentialed experts can, at the very least, capture who was logged in when things were deleted, what time it happened, what was deleted, what was moved. And a lot of times they can recreate that stuff. And this is true even before the Cloud came to be. A lot of documents are backed up on the cloud, but even the ones that are not often can be recreated on the device that they were wiped from. So, you should definitely assume that things can be retrieved for a price. The truth is, in a lot of cases, the forensics IT folks are going to be a whole lot smarter than the bad actor that deleted stuff off the computer, so you may get bits and pieces and history and tidbits of maneuvers to be able to piecemeal some of the data back for your investigation.