±Forensic Focus Partners
|New Today: 0||Overall: 36783|
|New Yesterday: 0||Visitors: 116|
Back to top Skip to content Skip to menu Back to top Back to main Skip to menu
Identity identificacion for deleted files
Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)Page Previous 1, 2, 3, 4
Are you looking at a logical image or physical image? Logical image will not have unallocated space. If your image is physical then at the bottom of the directory tree there should be a "grey" folder named "Lost Files". Additionally, you can right click the drive icon and choose "Recover Folders..."
- Senior Member
Yes, I already knew that but thank you for your advice. I made a physical copy of the HD, so that is why I'm wondering why the files aren't there! The client told me that after the deletion they had recovered a backup copy from the previous day (HP Openview DataProtector), but anyway, it still seem very strange to me that none of the interesting files are there anymore.