±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 0 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Identity identificacion for deleted files

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4 
  

nate
Member
 

Re: Identity identificacion for deleted files

Post Posted: Apr 25, 06 19:28

Are you looking at a logical image or physical image? Logical image will not have unallocated space. If your image is physical then at the bottom of the directory tree there should be a "grey" folder named "Lost Files". Additionally, you can right click the drive icon and choose "Recover Folders..."


Nate  
 
  

iruiper
Senior Member
 

Re: Identity identificacion for deleted files

Post Posted: Apr 25, 06 22:02

Yes, I already knew that but thank you for your advice. I made a physical copy of the HD, so that is why I'm wondering why the files aren't there! The client told me that after the deletion they had recovered a backup copy from the previous day (HP Openview DataProtector), but anyway, it still seem very strange to me that none of the interesting files are there anymore.  
 

Page 4 of 4
Page Previous  1, 2, 3, 4