Recovering deleted data

From ForensicsWiki
Revision as of 09:51, 25 January 2006 by Yale (Talk | contribs) (Rewrote the stub that was there)

Jump to: navigation, search

When the user requests to delete a file, most modern operating systems generally do not erase the actual data. For example, when a file in a FAT file system is deleted, the Root Directory entry and FATs are updated, but the data residing in the Data Area remains intact.

Recovery Programs

There are many programs that can recover these deleted files. Some of these softare packages are specifically designed for forensics purposes. For example, Scalpel and its predecessor, foremost, were developed to facilitate forensics investigations.