Recover a replaced ...
 
Notifications
Clear all

Recover a replaced file with the same name

nikmazdieizham
(@nikmazdieizham)
New Member

Hi, is there any chance recover a replaced file with the same name using FTK or EnCase?

Quote
Topic starter Posted : 28/04/2022 3:11 pm
Passmark
(@passmark)
Active Member

It's probably gone forever, unless you have a backup.

Depending on the file type and other factors (File system, file size, O/S, amount of time past since deletion, etc..) there is a small chance you can 'carve' the file.

Also depends on how the file was replaced. Deleted and recreated, or opened and overwritten.

Also check Volume Shadow Copies.

 

ReplyQuote
Posted : 04/05/2022 1:36 am
Share:
Share to...