ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn
Difference between revisions of "Recovering deleted data"
|(10 intermediate revisions by 7 users not shown)|
|Line 1:||Line 1:|
When the user requests to delete a file, most modern operating
When the user requests to delete a file, most modern operating the . , the the . the , the .
Revision as of 16:54, 13 June 2008
When the user requests to delete a file, most modern operating systems do not erase the actual data. Instead, they merely erase a pointer to the file so that the file does not appear in directory listings. These files can be recovered by simply undeleting the file — that is, restoring the directory entry.
For some file systems, such as FAT, the deleted directory entry itself is easily recovered. In these cases the files can be recovered using an undelete program. In other cases, however, the directory entry is not available — perhaps because it was overwritten. In these cases the only way that the file can be recovered is through the use of File Carving.