Preserving Digital Evidence - Image first, ask questions later
Digital evidence is volatile and subject to deliberate or accidental destruction. But deliberate deletion of files and emptying of the recycle bin do not, in fact, destroy the files. Timely action can recover them. The longer the delay and the more the computer is being used, the more likely it is that the deleted data will be overwritten.