Finding Deleted Pro...
 
Notifications
Clear all

Finding Deleted Program (exe) Files in FTK

4 Posts
3 Users
0 Likes
575 Views
TMD22
(@tmd22)
Posts: 41
Eminent Member
Topic starter
 

Can anyone tell me how to finds out if proogram (exe) files were deleted from a hard drive? I have FTK and only deleted "files" will show on the menu board.

My next guess would be the registry for this information?

Any help or input appreciated.

Mark

 
Posted : 14/01/2006 2:52 am
(@fatrabbit)
Posts: 132
Estimable Member
 

I'm unfamiliar with the interface of FTK so excuse my lack of knowledge, but as an .exe is a file wouldn't it also show up on that 'menu board' if all that menu board does is display reconstructed deleted files from any unallocated space on the image?

 
Posted : 14/01/2006 10:51 pm
(@armresl)
Posts: 1011
Noble Member
 

TMD more info would help give a better idea on how you can be helped here.

Can you expand on your first post please.

 
Posted : 14/01/2006 11:16 pm
TMD22
(@tmd22)
Posts: 41
Eminent Member
Topic starter
 

I believe the first post answered my question. EXE file should show up under deleted section of FTK.

I will try that myself later on.

Thanks all

 
Posted : 15/01/2006 2:04 am
Share: