I have a questions about FTK metacarve.
Does metacarving only recover files from deleted MFT record? If so, how some MFT record can get deleted except formatting the drive?
I have this situation on my case:
A file is recovered with metacarve and has MFT ID 81, and date parametar from year 2017. But, in existing MFT table, record with ID 81 is empty, but I was able to find MFT record for this metacarved file with WinHex, and it shows that it is in free space. More over, any other system files ($MFT, $Boot, $MFTMirr...) are with date parameter of year 2010. How is this possible?
Thank you in advance.