ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Recovering deleted data

From ForensicsWiki
Revision as of 17:07, 13 February 2007 by Simsong (Talk | contribs) (moved data to Carving page.)

Jump to: navigation, search

40px-Ambox warning pn.png

This article, and others, needs to be wikified.
Please remove this template after wikifying.

When the user requests to delete a file, most modern operating systems do not erase the actual data. Instead, they merely erase a pointer to the file so that the file does not appear in directory listings. These files can be recovered by simply undeleting the file---that is, restoring the directory entry.

For some file systems, such as FAT, the deleted directory entry itself is easily recovered. In these cases the files can be recovered using an undelete program. In other cases, however, the directory entry is not available---perhaps because it was overwritten. In these cases the only way that the file can be recovered is through the use of File Carving.

See Also