EnCase 8.08 Windows...
 
Notifications
Clear all

EnCase 8.08 Windows Recycle Bin  

  RSS
pajkow
(@pajkow)
Member

Hi all, it has been long time.

Got a question, how can I recover deleted entries from Windows Recycle Bin from Win 10 using EnCase 8.08 apart of Case Processor
I know that this option is avail in Wind Artifact Parser but have not found anything in there.

Is there any EnScript I can run over the entire image?

Quote
Posted : 10/07/2019 5:14 pm
kastajamah
(@kastajamah)
Member

Is it possible the subject deleted items without going through the recycle bin? Possible explanation as to why you are not finding anything.

ReplyQuote
Posted : 10/07/2019 6:05 pm
pajkow
(@pajkow)
Member

kastajamah - this is always possible. Got some keyword hits in unallocated in relation to Recycle bin in other tools but this is not complete that's why I asked about EnCase tools.

ReplyQuote
Posted : 11/07/2019 9:45 am
hommy0
(@hommy0)
Member

Hi,

Can I assume you are looking for deleted $I files?

I'm not aware of an EnScript that will recover these from the Unallocated Clusters (that doesn't mean one has not been written).

What sort of keyword hits are you finding in the Unallocated?

Regards

ReplyQuote
Posted : 11/07/2019 11:43 am
Share: