Electronic Discovery Expert Witness On “The Case For Electronic Discovery” Part 3

electronic evidence recovery expert witness Steven G. Burgess writes on: The Case for Electronic Discovery:

Saving a File
When a document is named, it is saved. It may be saved with a name such as “Untitled” even if not given a unique name by the author. When the file is saved, there are several attributes saved with it. One is the date the file was created; one is the date the file was last changed, or modified; one is the date the file was last accessed. This information is kept as part of a file listing called a “directory.” This file listing is viewed as a “folder” by the computer user. The computer saves a long version and a short version of the name as two adjacent directory listings as well.

The space on a computer’s hard disk is divided up into pieces called “sectors.” Each of these sectors contains 512 bytes of space, and a character (such as a letter or a number) generally takes up 2 bytes. Therefore, a sector can hold about 256 characters. When a file is about to be saved, the computer sets aside a “cluster” of space for it. A cluster is generally about 64 sectors. This cluster is assigned to the file whether or not the file needs all of the space in the cluster, and cannot be assigned to another file (except through malfunction) as long as the file still exists as a file. So, even if a file consists of one letter, which is 2 bytes in size, the computer allocates approximately 32,000 (actually 32,768) bytes of space. The file is then actually written to the first 2 bytes of the cluster, leaving the great majority of the cluster unchanged. Whenever a file exceeds one cluster in size, the computer sets aside another entire cluster for it.