What is an Encase "IS DELETED" file
Can anyone explain what the "IS DELETED" field in the Table pane of Encase means?
I see some files have a YES in the "IS DELETED" field. When looking up my notes, I only see this description
"Is Deleted displays "YES" if the entry is in a deleted state NO if it is not."
What exactly does "DELETED STATE" mean?
Are these files that are in the recycle bin?
Are these files that were removed from recycle but not over written yet?
Are these completely intact files that were Shift+Deleted and are still on the HD in their entirety?
Would appreciate some insight - I am trying to explain this to someone. I would like to show them some official documentation on this if possible too.
My EnCase manual states
"Is Deleted displays TRUE if the file is deleted but not emptied from the Recycle Bin."
If you have an EnCase license, you can get the manual in PDF form from the support portal.
Thank you! We do have a license and the manual, but it's back in the office and I was offsite when I posted this.