±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 4
Overall: 27389
Visitors: 53

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Encase naming confusing for overwritten and overwriting file

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Encase naming confusing for overwritten and overwriting file

Post Posted: Fri Aug 14, 2009 6:10 am

As you know, Encase uses the symbol 'red x' and says that these files are deleted overwritten files. So, you tend to think that the file with the icon red " x" was overwritten, but Encase shows the overwriting file, not the overwritten one. So, it sounds confusing, does not it?

Do you know why Encase calls a file overwritten while it actually shows the overwriting one? It actually shows you something different from what it says it does.

If it shows me an overwriting file, it should call it the overwriting file, not the overwritten file.

I know that some forensic examiners and newbies may be deceived by this. Would it not be better, if it called the area -rather than the file- overwritten and show the current file as overwriting?  

yunus
Senior Member
 
 
  

Re: Encase naming confusing for overwritten and overwriting file

Post Posted: Fri Aug 14, 2009 6:49 am

- yunus
Do you know why Encase calls a file overwritten while it actually shows the overwriting one? It actually shows you something different from what it says it does.


What you are seeing is a MFT record of a deleted file where the MFT record has not be overwritten but the file has. EnCase (in fact, no program of which I am aware), can display the contents of a file that has been overwritten. What EnCase is showing you is that the file pointer still exists though the file does not.

If you look at the very bottom of the EnCase Window (what they call the Navigation data or GPS), what is displayed is the path to actual file that now occupies the blocks occupied by the deleted file.  

seanmcl
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1