Electronic evidence recovery expert witness Steven G. Burgess writes on: The Case for Electronic Discovery:
Document Creation and Storage
Microsoft Word is the leading word processing program for office computers. When a document is begun in Microsoft Word, three things happen:* The new document is displayed on the screen.
* A “temporary” work file is created on the hard disk. Let us call this file “Work File A.” This file is invisible to the user.
* Data begins to churn though the virtual memory file, which is a physical file on the hard disk. Let us call this file the “VM file.” This file is also invisible to the user.When the author saves the document he or she is writing, a fourth thing happens:
* A file with a name given to it by the author is created on the computer’s hard disk. Let us call this file the “User Document.”
As the writer continues to write or update the document, changes occur within the User Document, these changes are reflected in Work File A, and much of this data is written into the VM file. As the writer changes and updates the User Document, much of the previous edition is invisibly archived into the User File as well as into the other two files we have mentioned. When the file is closed, “Work File A” is not saved as a document accessible to the user, but it continues to exist as a deleted file on the computer’s hard disk.
When the User Document is opened again, a new temporary and invisible Work File is created. It may be named “Work File B.” There may be several iterations of the creation of a Work File on a given hard disk, one corresponding to each time the User File is opened and viewed and/or modified, and correspondingly named “Work File C,” “Work File D,” etc.
If the User Document is saved with a different name, the document is still maintained on the hard disk with its original names, as well as with the new name.
Email and other documents behave in much the same way, although the specifics differ somewhat from program to program. Microsoft Outlook saves its email files somewhat differently from Microsoft Outlook Express, for instance.