Join Us!

Finding Deleted Pro...
 
Notifications
Clear all

Finding Deleted Program (exe) Files in FTK  

  RSS
TMD22
(@tmd22)
Junior Member

Can anyone tell me how to finds out if proogram (exe) files were deleted from a hard drive? I have FTK and only deleted "files" will show on the menu board.

My next guess would be the registry for this information?

Any help or input appreciated.

Mark

Quote
Posted : 14/01/2006 2:52 am
fatrabbit
(@fatrabbit)
Active Member

I'm unfamiliar with the interface of FTK so excuse my lack of knowledge, but as an .exe is a file wouldn't it also show up on that 'menu board' if all that menu board does is display reconstructed deleted files from any unallocated space on the image?

ReplyQuote
Posted : 14/01/2006 10:51 pm
armresl
(@armresl)
Senior Member

TMD more info would help give a better idea on how you can be helped here.

Can you expand on your first post please.

ReplyQuote
Posted : 14/01/2006 11:16 pm
TMD22
(@tmd22)
Junior Member

I believe the first post answered my question. EXE file should show up under deleted section of FTK.

I will try that myself later on.

Thanks all

ReplyQuote
Posted : 15/01/2006 2:04 am
Share: