Recover a replaced ...
 
Notifications
Clear all

Recover a replaced file with the same name

2 Posts
2 Users
0 Likes
1,470 Views
(@nikmazdieizham)
Posts: 1
New Member
Topic starter
 

Hi, is there any chance recover a replaced file with the same name using FTK or EnCase?

 
Posted : 28/04/2022 2:11 pm
Passmark
(@passmark)
Posts: 376
Reputable Member
 

It's probably gone forever, unless you have a backup.

Depending on the file type and other factors (File system, file size, O/S, amount of time past since deletion, etc..) there is a small chance you can 'carve' the file.

Also depends on how the file was replaced. Deleted and recreated, or opened and overwritten.

Also check Volume Shadow Copies.

 

 
Posted : 04/05/2022 12:36 am
Share: