What is an Encase &...
 
Notifications
Clear all

What is an Encase "IS DELETED" file

3 Posts
2 Users
0 Likes
930 Views
4n6art
(@4n6art)
Posts: 208
Reputable Member
Topic starter
 

Can anyone explain what the "IS DELETED" field in the Table pane of Encase means?

I see some files have a YES in the "IS DELETED" field. When looking up my notes, I only see this description
"Is Deleted displays "YES" if the entry is in a deleted state NO if it is not."

What exactly does "DELETED STATE" mean?
Are these files that are in the recycle bin?
Are these files that were removed from recycle but not over written yet?
Are these completely intact files that were Shift+Deleted and are still on the HD in their entirety?

Would appreciate some insight - I am trying to explain this to someone. I would like to show them some official documentation on this if possible too.

-=ART=-

 
Posted : 16/04/2009 12:16 am
(@kovar)
Posts: 805
Prominent Member
 

Greetings,

My EnCase manual states

"Is Deleted displays TRUE if the file is deleted but not emptied from the Recycle Bin."

If you have an EnCase license, you can get the manual in PDF form from the support portal.

-David

 
Posted : 16/04/2009 1:35 am
4n6art
(@4n6art)
Posts: 208
Reputable Member
Topic starter
 

Kovar

Thank you! We do have a license and the manual, but it's back in the office and I was offsite when I posted this.

Appreciate it.

-=Art=-

 
Posted : 16/04/2009 3:18 am
Share: