Digital Forensics
📋 What it is
Digital forensics recovers evidence from phones and computers — deleted files, timestamps, and logs.
🗣️ Coach says
Today’s crime scenes are often digital. “Deleted” files usually aren’t truly gone, timestamps show WHEN something happened, and logs show WHO logged in. Digital forensics reads the trail devices leave behind.
🧠 Memory hook
Deleted rarely means gone — timestamps and logs leave a digital trail.
😂 Giggle
What did the evidence bag say to the clue?
"I've got you contained!"
😲 Whoa!
When you “delete” a file, the data usually stays on the drive until it’s overwritten — which is how investigators recover “deleted” evidence months later.
✅ Quick check: Does deleting a file usually erase it completely right away?
Say your answer out loud first — then reveal.
No — the data typically remains until overwritten, so digital forensics can often recover it.
Deletion marks space as reusable but doesn’t immediately erase the data.
🧪 Try it! (2 minutes)
Notice the timestamps on your photos or messages — that “when” is exactly what digital forensics reads.