Recoverability of d...
 
Notifications
Clear all

Recoverability of data from virtual machine - advice needed

21 Posts
5 Users
0 Reactions
4,405 Views
(@studentoflife)
Active Member
Joined: 8 years ago
Posts: 15
Topic starter  

I misinterpreted the results
I was still able to retrieve email data from an FTK keyword search but not any data which was saved on the hard drive

There is something about the download method used by Microsoft that allows me to see the last 2-5 emails sent on the Windows Outlook app, with a matching keyword to the one I searched e.g.

On the 20th of December 2016 I created 3 VMs and emailed from within each one
" Today is Monday, no longer the holidays, Today is Tuesday, no longer the holidays, Today is Wednesday, no longer the holidays"

After a DBAN wipe I created a VM and emailed
" Today is Saturday, no longer the holidays"

After another DBAN wipe I created a VM and emailed
"Today is Sunday, no longer the holidays"

When the last VM created after the DBAN wipe was put into FTK Toolkit with the keyword search 'no longer the holidays' I was able to see the email sent post wipe (Saturday/Sunday) but not pre-wipe

This is just my observation )


   
ReplyQuote
Page 3 / 3
Share: