The truth is the same in both cases: sometimes "deleted" data is actually deleted, and sometimes it isn't. The difference is perspective: the user wants "deleted" data to be deleted and forensics people want it to be preserved.