Notifications
Clear all

FTK metacarve

1 Posts
1 Users
0 Likes
2,339 Views
(@ileile)
Posts: 7
Active Member
Topic starter
 

Hi all,

 

I have a questions about FTK metacarve.

Does metacarving only recover files from deleted MFT record? If so, how some MFT record can get deleted except formatting the drive?

I have this situation on my case:

A file is recovered with metacarve and has MFT ID 81, and date parametar from year 2017. But, in existing MFT table, record with ID 81 is empty, but I was able to find MFT record for this metacarved file with WinHex, and it shows that it is in free space. More over, any other system files ($MFT, $Boot, $MFTMirr...) are with date parameter of year 2010. How is this possible?

 

Thank you in advance.

Best.

 
Posted : 22/10/2020 12:46 pm
Share: