There were a few things that were running through my head regarding this topic.
1) I just wondered if somehow (again, its not something that I have fully researched), it was possible to extract where on the disk a file was when live, based on its unallocated position on the disk. But as the allocation process (on NTFS) seems to be very much first available position, its unlikely this would be achievable. To provide an example, an unallocated cached images was surrounding (physically on disk) by other cached files, suggesting that the unallocated image was a file found to be part of a cached web visit. But there are so many factors to consider here including browser type etc. And in reality, it seems that the allocation of files does not follow a process which would allow this.
2) I also wondered whether determining allocation patterns, the length of time file was deleted may be ascertainable. But no.
3) The likelihood of a file having been overwritten based on the current setup, state and usage on the disk to prevent lengthy recovery processes.
But to be honest, Im now thinking this is something that just does contribute on any of the above points.
But to be honest, Im now thinking this is something that just does contribute on any of the above points.
I'm not at all sure that I'm clear as to what that means.