Sort of agree, but I think surely thats over simplified. Things like cluster size, allocation algorithms etc - also impacting?
I think length of time used is not as important as the number of transactions taking place (likely one is linked to the other).
Maybe its worth simplifying to say a simple USB memory stick. Say for example, a suspect saves x,y and z on there. Yes, time isnt an issue here, but for example, how likely is natural overwriting to occur. For example, just because a file saved and deleted, then in NTFS, will that portion of the disk not be used at next optimal time as opposed to writing to over areas of the disk. Therefore even a small amount of usage will likely lead to natural overwriting, it doesnt need to be a lot?
Again, i think in practical terms its not massively useful, but knowledge wise maybe interesting.
...Another point, often its not possible to tell how long something has been deleted for. Could understanding deletion and overwritten processes maybe lead to estimates? Hey, i dunno, just throwing random thoughts out there.
↧