EnCase 8.08 Windows Recycle Bin
Hi all, it has been long time.
Got a question, how can I recover deleted entries from Windows Recycle Bin from Win 10 using EnCase 8.08 apart of Case Processor
I know that this option is avail in Wind Artifact Parser but have not found anything in there.
Is there any EnScript I can run over the entire image?
Is it possible the subject deleted items without going through the recycle bin? Possible explanation as to why you are not finding anything.
kastajamah - this is always possible. Got some keyword hits in unallocated in relation to Recycle bin in other tools but this is not complete that's why I asked about EnCase tools.
Can I assume you are looking for deleted $I files?
I'm not aware of an EnScript that will recover these from the Unallocated Clusters (that doesn't mean one has not been written).
What sort of keyword hits are you finding in the Unallocated?