±Forensic Focus Partners
New Today: 2
New Yesterday: 1
±Follow Forensic Focus
· TSFIC 2015 – Myrtle Beach 31st May – 3rd June
· Forensics Europe Expo 2015 – Recap
· Capturing RAM Dumps and Imaging eMMC Storage on Windows Tablets
· TDFCon 2015 – Middlesbrough 15th May
· Electronic Voiceprints: The Crime Solving Power of Biometric Forensics
· DFRWS Europe 2015 Annual Conference – Recap
· DFRWS EU 2015 – Dublin 23rd – 26th March
· SQLite Database Forensics – ‘Sleep Cycle’ Case Study
· Data Recovery As A Medium For Email Forensics
Encase naming confusing for overwritten and overwriting file
Do you know why Encase calls a file overwritten while it actually shows the overwriting one? It actually shows you something different from what it says it does.
If it shows me an overwriting file, it should call it the overwriting file, not the overwritten file.
I know that some forensic examiners and newbies may be deceived by this. Would it not be better, if it called the area -rather than the file- overwritten and show the current file as overwriting?
- Senior Member
- yunusDo you know why Encase calls a file overwritten while it actually shows the overwriting one? It actually shows you something different from what it says it does.
What you are seeing is a MFT record of a deleted file where the MFT record has not be overwritten but the file has. EnCase (in fact, no program of which I am aware), can display the contents of a file that has been overwritten. What EnCase is showing you is that the file pointer still exists though the file does not.
If you look at the very bottom of the EnCase Window (what they call the Navigation data or GPS), what is displayed is the path to actual file that now occupies the blocks occupied by the deleted file.
- Senior Member