Notifications
Clear all
Topic starter
Hi, is there any chance recover a replaced file with the same name using FTK or EnCase?
Posted : 28/04/2022 2:11 pm
It's probably gone forever, unless you have a backup.
Depending on the file type and other factors (File system, file size, O/S, amount of time past since deletion, etc..) there is a small chance you can 'carve' the file.
Also depends on how the file was replaced. Deleted and recreated, or opened and overwritten.
Also check Volume Shadow Copies.
Â
Posted : 04/05/2022 12:36 am