±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35883
New Yesterday: 1 Visitors: 138

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Encase how to recover broken excel files

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

watcher
Senior Member
 

Re: Encase how to recover broken excel files

Post Posted: Apr 01, 19 16:06

- irfanion
... the suspect's laptop are using SSD. ... Encase only give me the names of the file, and when i try to recover excel for instance, it cannot be opened. Files are damaged. ...
I also try to recover using free online excel recover tools and it does'nt help.


If the laptop was running a properly functioning TRIM with the SSD (surprisingly many don't), you're unlikely to recover the deleted file contents.

Your best bet was already posted:

- keydet89
Volume Shadow Copies?

^^^^^^^^ This ^^^^^^^^^^^^  
 
  

irfanion
Newbie
 

Re: Encase how to recover broken excel files

Post Posted: Apr 02, 19 02:31

- watcher
- irfanion
... the suspect's laptop are using SSD. ... Encase only give me the names of the file, and when i try to recover excel for instance, it cannot be opened. Files are damaged. ...
I also try to recover using free online excel recover tools and it does'nt help.


If the laptop was running a properly functioning TRIM with the SSD (surprisingly many don't), you're unlikely to recover the deleted file contents.

Your best bet was already posted:

- keydet89
Volume Shadow Copies?

^^^^^^^^ This ^^^^^^^^^^^^



I know it's not easy if the medium is SSD, so i try to ask for help here and other forum. Hope i can get some revelation Smile


Yes, already tried that. Found the files, still can't be opened. File damaged/corrupted. I've tried to open it as zip, and extract the xml. It is broken. Thanks for your input though.


What's bothering me is that the suspect delete those files at 3/21 at midnight, we do the acquisition 3/22 in the evening. I'm quite sure he's not tech savvy doesn't know about anti forensic and so on..  
 
  

jaclaz
Senior Member
 

Re: Encase how to recover broken excel files

Post Posted: Apr 02, 19 10:23

- irfanion

Yes, already tried that. Found the files, still can't be opened. File damaged/corrupted. I've tried to open it as zip, and extract the xml. It is broken. Thanks for your input though.


And AGAIN "damaged/corrupted" or "failed to open as zip" may still (or it may not) mean that a given file is (totally or partially) recoverable.

How many different zip recovery tools have you run without results on these files?
0, 1 or 5?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

watcher
Senior Member
 

Re: Encase how to recover broken excel files

Post Posted: Apr 02, 19 14:40

- irfanion
... Yes, already tried that. Found the files, still can't be opened. File damaged/corrupted. I've tried to open it as zip, and extract the xml. It is broken. ...


By "that", I assume you mean "Shadow Copies"?

Out of curiosity, how many shadow versions did you find?
What were their associated dates?

Were they all corrupt?  
 

Page 2 of 2
Page Previous  1, 2