Imagine that you are investigating a case where the suspect is believed to have deleted information from his or her device that might be evidence. Where would you look for this evidence? Why?