drop binary sample of file slack or unallocated space · identify overwrite patterns from specific secure delete tools · fingerprint the wipe method used · assess what if anything is recoverable · runs locally
SDelete · DoD 5220.22-M · Gutmann · cipher /w · BleachBit · Eraser · single-pass zero/random
drop file slack or unallocated-space binary sample (multi-file)