You have not mentioned what kind of document it was. Ie, pdf, doc, docx, txt.. If the file header has been overwritten, it could be an idea to search the disk for "content related / structure related" stuff. For instance docx have a well known structure and even though the header is missing, it may still be possible to identify and recover individual parts of the file (it's basically just a bunch of deflated xml files glued together).
I would recommend go step by step
1. Post Imaging & Verification recover all the deleted information using encase. (I assume its done)
2. Decompress all the zipped files
3. Recover all the protected files separately
4. Extract the file type you are looking for.
5. Use foremost to recover data from unallocated space.
Well if you have done all of the above & you still don't have the information, you might as well check if any anti-forensics tools were used post deleting the user account.
13th law of data recovery might be applicable if the data is not where you are looking you either aren't looking in the right place, or, it's right there, staring you in the face, but you don't see it.
Are those the only two choices I get?
Actually, Law 13 says 'you're not looking in the right place.' and stops there.
I tried to add the all-too-common staring-you-in-the-face scenario, but I only messed up the 13th law. Sorry.
That is, you don't even get a choice. You are free to formulate Law 43 and up, though.
No, I won't answer the next question.
this leaves compressed (either windows compression, docx compression or an archive file (zip) etc)
Actually DOCX format and ZIP format are the same. So if you carve the disk for ZIP files you might pick up some Office files.
You can take a DOCX file (and other files like XLSX) and rename them to a ZIP file and open them with WinZip.
As pointed out in one of the other posts, a DOCX file contains a bunch of compressed XML files with names like, document.xml, footer1.xml, styles.xml, etc..
Thanks chaps. No evidence of compression and Encase picked up all the docx files both extant and deleted. I have returned the drive to the client so no further input required. Looks like Law 13 prevails.