Notifications
Clear all

FTK metacarve  

  RSS
ileile
(@ileile)
New Member

Hi all,

 

I have a questions about FTK metacarve.

Does metacarving only recover files from deleted MFT record? If so, how some MFT record can get deleted except formatting the drive?

I have this situation on my case:

A file is recovered with metacarve and has MFT ID 81, and date parametar from year 2017. But, in existing MFT table, record with ID 81 is empty, but I was able to find MFT record for this metacarved file with WinHex, and it shows that it is in free space. More over, any other system files ($MFT, $Boot, $MFTMirr...) are with date parameter of year 2010. How is this possible?

 

Thank you in advance.

Best.

Quote
Posted : 22/10/2020 1:46 pm
Share: