Difference between revisions of "Recovering deleted data"

From ForensicsWiki
Jump to: navigation, search
m (Reverted edit of Porker, changed back to last version by Uwe Hermann)
Line 1: Line 1:
Man shot dead at vehicle checkpoint
+
When the user requests to delete a file, most modern [[operating system]]s generally do not erase the actual data. For example, when a file in a [[FAT]] [[file system]] is deleted, the Root Directory entry and FATs are updated, but the data residing in the Data Area remains intact.
A man has been shot dead by police at a vehicle checkpoint in Northern Ireland. Officers fired a number of rounds during the incident on Church Street in Ballynahinch, County Down. The man shot dead was the , County Down. The man shot dead was the
+
 
 +
== Recovery Programs ==
 +
 
 +
There are many programs that can recover these deleted files. Some of these software packages are specifically designed for forensics purposes. For example, [[Scalpel]] and its predecessor, [[foremost]], were developed to facilitate forensics investigations.

Revision as of 11:56, 16 April 2006

When the user requests to delete a file, most modern operating systems generally do not erase the actual data. For example, when a file in a FAT file system is deleted, the Root Directory entry and FATs are updated, but the data residing in the Data Area remains intact.

Recovery Programs

There are many programs that can recover these deleted files. Some of these software packages are specifically designed for forensics purposes. For example, Scalpel and its predecessor, foremost, were developed to facilitate forensics investigations.