±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35750
New Yesterday: 1 Visitors: 81

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

EnCase 8.08 Windows Recycle Bin

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

pajkow
Senior Member
 

EnCase 8.08 Windows Recycle Bin

Post Posted: Jul 10, 19 16:14

Hi all, it has been long time.

Got a question, how can I recover deleted entries from Windows Recycle Bin from Win 10 using EnCase 8.08 apart of Case Processor
I know that this option is avail in Wind Artifact Parser but have not found anything in there.

Is there any EnScript I can run over the entire image?  
 
  

kastajamah
Senior Member
 

Re: EnCase 8.08 Windows Recycle Bin

Post Posted: Jul 10, 19 17:05

Is it possible the subject deleted items without going through the recycle bin? Possible explanation as to why you are not finding anything.  
 
  

pajkow
Senior Member
 

Re: EnCase 8.08 Windows Recycle Bin

Post Posted: Jul 11, 19 08:45

kastajamah - this is always possible. Got some keyword hits in unallocated in relation to Recycle bin in other tools but this is not complete that's why I asked about EnCase tools.  
 
  

hommy0
Senior Member
 

Re: EnCase 8.08 Windows Recycle Bin

Post Posted: Jul 11, 19 10:43

Hi,

Can I assume you are looking for deleted $I files?

I'm not aware of an EnScript that will recover these from the Unallocated Clusters (that doesn't mean one has not been written).

What sort of keyword hits are you finding in the Unallocated?

Regards  
 

Page 1 of 1