Recovering data from a hard drive is one of the most common tasks during a computer investigation. Here are a few of the artifacts which computer investigators may retrieve from unallocated (free) space to assist in a case:

* MS Office documents

* Acrobat files (.pdf)

* Email messages and attachments

* Images in various formats

* Internet history (pages visited, searches)

* Registry files (current and past)

* File access records (when and where files were opened)

* Pre-fetch files (when a specific program was ran)