Clear all

FTK metacarve

New Member

Hi all,


I have a questions about FTK metacarve.

Does metacarving only recover files from deleted MFT record? If so, how some MFT record can get deleted except formatting the drive?

I have this situation on my case:

A file is recovered with metacarve and has MFT ID 81, and date parametar from year 2017. But, in existing MFT table, record with ID 81 is empty, but I was able to find MFT record for this metacarved file with WinHex, and it shows that it is in free space. More over, any other system files ($MFT, $Boot, $MFTMirr...) are with date parameter of year 2010. How is this possible?


Thank you in advance.


Topic starter Posted : 22/10/2020 1:46 pm