deleted evidence

The controller knew the audit was coming. Over one long weekend, he deleted a folder of spreadsheets, cleared his browser history, wiped the text threads on his company phone, and emptied the recycle bin. On Monday, he walked in confident that the evidence was gone.

It was not. Within days, examiners had rebuilt much of what he deleted from server backups, cloud sync logs, email archives, and file system records he never knew existed.

That gap between what fraudsters think they destroyed and what investigators can actually recover is where many cases are won. According to the ACFE’s Occupational Fraud 2026: A Report to the Nations, which analyzed 2,402 cases across 143 countries, organizations lose an estimated 5% of revenue to fraud each year, with a median loss of $104,000 per case. The ACFE’s 2024 report found that 89% of fraudsters took steps to conceal their schemes, and 23% destroyed or withheld physical documents. When records disappear, deleted evidence often becomes the most important evidence in the case.

Why Fraudsters Destroy Data (and Why It Backfires)

Concealment is part of almost every fraud. In the ACFE’s 2024 data, 31% of perpetrators created fraudulent electronic documents and 28% altered existing ones. Deletion is usually the next step once someone senses scrutiny.

The problem for the fraudster is that deletion rarely erases everything. Worse, the act of destroying records can be evidence in its own right:

  • It suggests intent. Wiping files right after an audit notice tells its own story.
  • It can be a separate federal crime. Under 18 U.S.C. § 1519, knowingly destroying or altering records to obstruct a federal investigation carries up to 20 years in prison.
  • It can sink a civil case. Under Federal Rule of Civil Procedure 37(e), courts can instruct juries to presume lost electronic information was unfavorable, or even end the case, when a party destroyed it intending to deprive the other side.

This is not theory. Section 1519 came out of the Sarbanes-Oxley Act of 2002, passed after Arthur Andersen staff shredded Enron-related documents.

Where Deleted Evidence Actually Hides

When a user hits “delete,” most systems simply mark the space as available. The underlying data, and many traces of it, can persist in places the user never sees. Common sources of recoverable deleted evidence include:

  • Unallocated space on traditional hard drives, where file fragments remain until overwritten
  • File system metadata, such as records showing file names, creation dates, and when files were opened or removed
  • Operating system artifacts, including recent file lists, shortcut files, and Windows shadow copies
  • Email servers and archives, which often retain messages long after a user deletes them locally
  • Cloud services and sync logs from platforms like Microsoft 365 or Google Workspace, which record activity, versions, and deletions
  • Mobile backups, where deleted texts and app data may survive on a computer or in the cloud
  • Backups and network logs, which capture snapshots the user cannot easily reach

Text messages are a frequent turning point. Our case breakdown of a CFO fraud exposed by a single text message shows how one recovered conversation can unravel years of concealment.

How Investigators Recover Deleted Evidence

Recovery is not a single trick. It is a disciplined process designed to produce findings that hold up in court. Guidance from NIST’s Guide to Integrating Forensic Techniques into Incident Response (SP 800-86) frames it in four phases: collection, examination, analysis, and reporting.

  1. Preserve first. Examiners create a verified forensic image, a bit-for-bit copy, and confirm it with hash values so no one can claim the evidence was altered.
  2. Recover and carve. Specialized tools search unallocated space and rebuild files from fragments, even when file names are gone.
  3. Build a timeline. Metadata and logs show what was created, edited, or deleted, and when. Timelines often reveal deletion bursts that line up with key events, like an audit notice or a resignation.
  4. Correlate sources. Investigators match recovered files with bank records, ledgers, and emails to connect digital activity to the money.
  5. Document everything. Chain of custody and repeatable methods make the findings defensible.

Deleted evidence is only one piece of the picture. Learn what evidence fraud investigators actually look for across a full case.

For a broader look at how this work fits into a full engagement, see our guide to the role of digital forensics in modern fraud investigations.

The Honest Limits: When Data Really Is Gone

Transparency matters, so here is the reality. Not all deleted evidence can be recovered.

Modern solid-state drives (SSDs) use a feature called TRIM that can permanently clear deleted data far faster than older hard drives. Encrypted devices, secure wiping tools, and overwritten storage can also put files beyond reach.

Even then, investigators often find the footprints. Traces of wiping software, gaps in logs, missing backup sets, and copies stored elsewhere can all show that deleted evidence once existed and that someone worked to remove it. That pattern alone can carry significant weight in court.

This is also why speed matters. The longer a device stays in use, the more likely deleted evidence is overwritten.

What Your Organization Should Do Right Now

You can dramatically improve your odds of recovering deleted evidence by acting before and after an incident:

  • Issue a litigation hold as soon as fraud is suspected, and suspend any automatic deletion policies for relevant accounts.
  • Do not let IT “take a look.” Opening files or reimaging a laptop can overwrite evidence. Isolate the device and call a qualified examiner.
  • Preserve before confronting. Secure devices, email, and cloud accounts before the suspected employee knows. Our guide on how to terminate an employee suspected of embezzlement explains the timing.
  • Retain logs and backups. Turn on audit logging in your email and cloud platforms, and keep backups long enough to matter.
  • Control company devices. Clear policies on company-owned phones make lawful collection far easier.

The early steps are critical. Our checklist for the first 48 hours after discovering fraud walks through exactly what to secure and when.

Finally, remember that recovered data must be admissible. Mishandled evidence can be excluded, as we explain in admissible evidence in court vs. thrown out.

Conclusion: Destruction Leaves a Trail

Fraudsters delete files because they believe deletion equals safety. In practice, deleted evidence often survives in backups, logs, metadata, and the cloud, and the attempt to destroy it can become one of the strongest facts in the case.

The difference between recovering that evidence and losing it usually comes down to the first few decisions your organization makes. Preserve quickly, avoid well-meaning shortcuts, and bring in forensic professionals who can recover deleted evidence with methods that stand up to scrutiny.

FraudOrder combines forensic accounting and investigative expertise with a commitment to integrity, accuracy, and client protection. If you suspect records have been altered or destroyed, contact FraudOrder for a confidential consultation before the evidence trail grows cold.

Frequently Asked Questions

1. Can deleted files really be recovered?

Often, yes. On traditional hard drives, deleted data can remain until it is overwritten, and copies frequently exist in backups, email servers, and cloud services. Recovery is less likely on SSDs and encrypted devices, but traces of the activity usually remain.

2. Can deleted text messages be recovered for a fraud investigation?

In many cases, deleted texts can be recovered from device backups, cloud accounts, or synced computers. Success depends on the device, settings, and how much time has passed. Collection must also follow applicable privacy and consent laws.

3. What should we do if we suspect an employee is deleting evidence?

Preserve immediately. Isolate company devices, suspend auto-deletion, secure email and cloud accounts, and avoid alerting the employee. Then engage a qualified forensic examiner before anyone opens or reimages the devices.

4. Is destroying evidence a crime?

It can be. Under 18 U.S.C. § 1519, destroying or altering records to obstruct a federal investigation carries up to 20 years in prison. In civil cases, courts can impose serious sanctions for destroying electronic information.

5. Will recovered deleted evidence hold up in court?

It can, if it is collected and handled properly. Forensic imaging, hash verification, chain-of-custody documentation, and repeatable methods are what make findings defensible. Evidence gathered informally by untrained staff is much easier to challenge.

6. How quickly should we contact a forensic investigator?

As soon as fraud is suspected. Every day a device stays in use increases the risk that deleted evidence is overwritten. FraudOrder can advise on immediate preservation steps during an initial consultation.

References

Disclaimer

This article is for informational purposes only and does not constitute legal, financial, or professional advice. Reading it does not create a client relationship with FraudOrder. Consult qualified legal and forensic professionals about your specific situation. For questions about FraudOrder services, visit https://fraudorder.co/