Prove that you deleted the file

Question

Is it possible to prove a date that you Deleted a file through the recycle bin? I delete a folder of pictures 2 months ago and somebody is asking to prove that I did it.

Answer 1

Respond by asking them to prove that they brushed their teeth on the night of March 14th 2013.

---

From a technical perspective, this isn't possible unless you've explicitly set up directory auditing to log when files are deleted. Since I almost guarantee that you haven't done this: no, there is pretty much no way you can prove such a thing. Even with auditing, you may well have copied the data to a secondary place via other channels - even something as low-tech as a print screen or taking a photo of your monitor.

Answer 2

What you are talking about would require a perfect DRM system that can prove that you can only access the file in the way that is governed by a system that does not allow copying and provides a cryptographic receipt for deletion.

There are systems that try to do this, but all are susceptible to being cracked as thus far DRM is not really a secure platform and never will be unless hardware stops being owned by the user. (Which would be very bad for a number of reasons and hopefully will never happen.)

As far as your simple case of a non-DRM system where you simply put the file in the trash, there is absolutely no way to prove it what so ever because the system doesn't even attempt to keep track of what files have been copied and when, so even if you could prove you deleted A copy (which would require undeleting the file most likely), you can't prove that even a copy of the file has been permanently deleted the way most file systems work.

Answer 3

Having built eDiscovery systems for corporations, ALL philosophy aside... on a computer system - even with all auditing in place there is NO legal way to prove a file has been deleted without sworn witnesses, and then that is even specious. Even if you had a file system audit, I have written low-level eDiscovery tools that while moving items around had to manipulate file time-stamp information to keep them in synch and not loose forensically valuable information (yes, I know a cheat, but unfortunately a required cheat). So it is possible to cheat.

The existence of a file is either there or not. The proof of any act of removal on a given time/date, is entirely another issue that computers would not be capable of providing a reliable, legally acceptable proof - without human intervention.

Answer 4

Ok, before telling you that you if you can or not, let's analyze what happens in the computer, step by step.

1- You got a picture somehow. Be it by copying from the cell phone, or downloading it from a site, or saving from an attachment from a email.

(I imagine that you're using Windows, but it would work almost the same if it is a Mac or a Linux or anything else)

In that case, Windows will store the picture (the file) in your hard disk. And it will create references to that file, like the name, the size, in which folder it was saved, etc. When you open Windows Explorer, your able to navigate through the folders and find the file, open it, etc.

2- Someone asks you to delete the file.

You move it to trash bin. Windows just updates the information he had: now he knows the file is in the Trash bin, but was in the blahblah folder earlier, allowing you to untrash (undelete) it. Ok ?

3- You delete it from the Trash bin.

You empty the trash bin, or you go inside the trash bin and delete just the file. Windows will know that you don't want to recover that file anymore, so it removes all references for that file. The content is still in your hard disk, but there's no way to open it using Windows Explorer anymore.

3.1 - Let's say it was an important file that you wish to recover.

Some special programs could access the whole of your hard drive, trying to read the file. Since the content of the file would be inside the hard disk, it could find it. And then the program would recover it, creating again all the references to folders, etc., so that you could open it again.

But, as time passes by, that space in the hard disk could have just been rewritten: since Windows doesn't know anymore that in that position used to be a file, it can overwrite it with some newer file, and you will never be able to recover it again.

Ok, so we know that you can have a file inside your computer, can erase it, can try to recover it, but it might not be that easy.

What you are asking is "have Windows recorded, somewhere, that I have deleted the file?"

As you can see, we never said that Windows would keep a log of your activities, so there are many things that Windows won't know: 1. it won't know if you have copied the file to a pendrive, or to another folder, or have copied and renamed it.. 2. it won't record, anywhere, when you moved the file to trash, when you emptied the Trash bin 3. it won't know if that position in the hard drive was overwritten, because it won't know where the picture was saved, anymore, since you deleted it. It will just know where new files are stored.

Some special systems try to keep track of everything. Some versions of Windows, for example, when auditing options are enable, can keep a track of all your actions in the computer. But not the general, home-version of Windows.

And even in those systems there are ways to fool it and copy the file, making a "backup" of the picture, etc.

What the other answers are trying to tell you is exactly that: in general, a home computer won't keep a track of your actions, so that you can prove that you don't have the file anymore. Some programs might be able to prove the other way round: that you had the file, that there is still some copy of it inside your hard disk, etc. But is impossible to prove that you don't have it anymore.

And that's what you'll have to explain to the person that is asking you about it: your computer doesn't keep a track of all your actions, and even if it did, there are people with special knowledge that can circumvent it.

Answer 5

This is almost beyond a technical question (going into the information theory/philosophical), as you're attempting to prove a negative (the nonexistence of said pictures). If you actually did delete them then s/he is just going to have to trust you. If you're comfortable with it you could let them perform some level of search on your system(s) to satisfy some level of verification, but there is no technological way of proving this.

Also, use SnapChat next time (if you trust them not to use the screenshot hack).