“The recovery tool found nothing” is an observation about a method applied to a collection. It does not identify why content is unavailable or whether an actor intended its removal. Start with a precise evidence question: whether a specified object or recognizable content was located in the acquired material using the documented methods.
Identify the bytes that were available to examine
Record whether the input is a physical image, a logical file collection, a virtual disk, a snapshot, or an export from a service. Preserve acquisition errors, unreadable regions, encryption and access limitations, image segments, and relevant storage configuration. A logical export that excludes unallocated space cannot support a conclusion about searching that space.
NIST SP 800-86 supplies a foundational collection and analysis framework, published in 2006. It does not describe every modern storage controller. Use it to structure the evidence record while consulting current platform and device documentation for actual behavior.
Keep filesystem and device behavior separate
The filesystem's deletion or allocation records, the bytes returned by the storage interface, and the device's internal management are different layers. Microsoft’s TRIM and UNMAP explanation describes hints that identify storage no longer needed and discusses virtual and thinly provisioned storage. It is historical Windows compatibility documentation, not a test of a particular current SSD.
The existence of a feature does not establish that it ran for a specific object, that every intermediate layer passed it through, or that a particular physical result followed. Record the actual interface, virtualization layers, available configuration, and device evidence. Avoid translating an all-zero region directly into “securely wiped” without supporting mechanism evidence.
Describe the recovery method's recognition limits
Record tool version, input selection, supported filesystem, search terms, signatures, filters, and error output. A parser can miss an unsupported variant. A carving method can fail on fragmented, transformed, encrypted, or unsupported content. These are hypotheses to evaluate against the source and tool documentation; they are not an explanation that must apply in every case.
If the conclusion matters, use an appropriate known input or independent method to test the specific feature. Successful recovery of another file shows some capability under those conditions; it does not prove complete sensitivity for the target. Preserve candidate fragments and their offsets separately from complete recovered objects.
Use a claim ladder
- Search observation: no matching item was located under the recorded method and scope.
- Availability assessment: identified collection or storage conditions could restrict recovery.
- Mechanism assessment: additional records support a particular change or process.
- Attribution and intent: separate evidence connects an actor and purpose to that mechanism.
Each step needs more evidence; the first does not imply the last. An object may survive in a backup, service, recipient's copy, or other authorized source even when it is unavailable in the examined image. Keep such sources as collection opportunities, not promises of recovery.