Modern filesystems make forensic file recovery much more difficult. Tools like Foremost and Scalpel identify data structures and carve files from a hard disk image.
Look here for archived tutorials and talks from USENIX Security '08. Each comprises a video and recorded presentation slides which are shown parallel to the talk.