Abstract
Permanent file deletion on USB storage media is often assumed to completely remove data from the device. Technically, however, this process only deletes file system metadata references while the physical data remains on the storage media until overwritten. This study aims to analyze the file recovery process of permanently deleted files using a digital forensic approach based on the ISO/IEC 27037 standard. The research was conducted using a scenario involving the permanent deletion of ten files from a USB flash drive on a Windows operating system. Digital evidence acquisition was performed using FTK Imager, while examination and file recovery were carried out using Autopsy. The results indicate that all deleted files were successfully recovered because the storage sectors had not been overwritten. The compliance analysis with ISO/IEC 27037 shows that all digital forensic stages were conducted in accordance with the principles of authenticity, integrity, and traceability of digital evidence. This study is expected to serve as a practical and academic reference for the implementation of international standard–based digital forensic investigations on removable storage media.