[Kelly Crooks]

The three major categories of evidence that are discussed in the book are Archival Data, Backup Data, and Residual data.

Archival Data is data that is no longer active. Archival data is stored separately on another device to free up space on the system hard drive or media device. Some examples of Archival data include things such as letters, maps, and statistics. Archival data is retained so that it can be accessed at a later time but not stored on the operating system drive. Archival data is like data that has been put into storage, it is there when needed but not taking up space on your hard drive.

Backup data is just that, files or programs that have been backed up to a safe location or area. Backup data is used in case a file is lost, stolen, or deleted from the system hard drive. Backup data can be easily accessed in the case of emergencies or a system failure. Backup data is usually stored on a portable device like a USB flash drive, the cloud, an external hard drive, or any portable media device. I have my Quickbooks back up all the data after every third time I log out of the system. It is stored on a USB flash Drive that I can take between computers if I need to.

Residual data is data that the end user thinks is gone but is recoverable from digital media. Residual data can include files or programs that a user “deletes” from the system but is not deleted at all, it is just not visible anymore. The data is stored at other locations within the system. Residual data, while being deleted and no longer visible with the application with which the file was created is still on the system. Residual data is inactive data on a computer system.