Recovering information on deleted files
Hi all,
Im new to the area of computer forensics, and was wondering if anyone on this board could clear something up for me;
When a file is deleted, it isnt 'deleted' (or as is my understanding), it is only "moved or something". Can someone tells me exactly what happens when you delete a file?
Also, when authorities such as the Police and the FBI seize a computer, how do they recover information on "deleted" files? Does it take a long time, or are there programs available that can help with the matter?
Thank you for your help in advance :)