Experts say retaining such data would be prohibitively expensive since the unallocatedspace is essentially a trash bin that is altered each time a key is tapped.
But during the process of encryption, unencrypted copies of those files were stored in the unallocatedspace, where discarded files are temporarily kept in pieces without the identifying data to find them or reassemble them easily.
It also makes it easier to find the files that have been created, accessed and modified during an attack, and it is able to reconstruct deleted files from raw data found in various hidden parts of a computer's hard disk, such as unallocatedspace and file slack.