±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35657
New Yesterday: 3 Visitors: 174

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

What is an Encase "IS DELETED" file

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

4n6art
Senior Member
 

What is an Encase "IS DELETED" file

Post Posted: Apr 16, 09 00:16

Can anyone explain what the "IS DELETED" field in the Table pane of Encase means?

I see some files have a YES in the "IS DELETED" field. When looking up my notes, I only see this description:
"Is Deleted: displays "YES" if the entry is in a deleted state NO if it is not."

What exactly does "DELETED STATE" mean?
Are these files that are in the recycle bin?
Are these files that were removed from recycle but not over written yet?
Are these completely intact files that were Shift+Deleted and are still on the HD in their entirety?

Would appreciate some insight - I am trying to explain this to someone. I would like to show them some official documentation on this if possible too.

-=ART=-  
 
  

kovar
Senior Member
 

Re: What is an Encase "IS DELETED" file

Post Posted: Apr 16, 09 01:35

Greetings,

My EnCase manual states:

"Is Deleted displays TRUE if the file is deleted but not emptied from the Recycle Bin."

If you have an EnCase license, you can get the manual in PDF form from the support portal.

-David
_________________
CISSP, CCE, EnCE, Licensed Private Investigator (CA) 
 
  

4n6art
Senior Member
 

Re: What is an Encase "IS DELETED" file

Post Posted: Apr 16, 09 03:18

Kovar:

Thank you! We do have a license and the manual, but it's back in the office and I was offsite when I posted this.

Appreciate it.

-=Art=-  
 

Page 1 of 1