Disk block map
– blocks
free (never used)
file data (present)
deleted (data intact)
overwritten (destroyed)
Chain of custody / timeline
hash before & after each action