But the file system overrides the (former) file content eventually. You don't have a guarantee you can retrieve the content anymore. You'd need to use forensic

But the file system overrides the (former) file content eventually. You don't have a guarantee you can retrieve the content anymore. You'd need to use forensic tools for that anyway. I think any jury can understand this. Setting a flag in a database column is a big difference, as the data never becomes purged eventually.