Bottom Line: The deletion of a file or the Reformat of a hard disk provides essentially no level of security. Left behind: Ambient data is a forensic term which describes, in general terms, data stored in non-traditional computer storage areas and formats:
- Windows Swap/Page File
These are "scratch pad" files to write data when additional random access memory is needed. (100MB to over 1GB. They contain remnants of any work that may have occurred.
- Unallocated File Space
When files are erased or deleted the file is not actually erased. Data from the 'erased file' remains behind in an area called unallocated storage space.
- File Slack
Files are stored in fixed length blocks of data called clusters. Rarely do file sizes exactly match the size of one or multiple clusters perfectly. The extra data storage space that is assigned to a file is called "file slack". File slack contains padded data from memory and remains undeleted.
- Shadow Data
Shadow data contains the remnants of computer data that was written previously to a track and it is located slightly outside the track's last write path.