Join Us!

What is an Encase &...
 
Notifications
Clear all

What is an Encase "IS DELETED" file  

  RSS
4n6art
(@4n6art)
Active Member

Can anyone explain what the "IS DELETED" field in the Table pane of Encase means?

I see some files have a YES in the "IS DELETED" field. When looking up my notes, I only see this description
"Is Deleted displays "YES" if the entry is in a deleted state NO if it is not."

What exactly does "DELETED STATE" mean?
Are these files that are in the recycle bin?
Are these files that were removed from recycle but not over written yet?
Are these completely intact files that were Shift+Deleted and are still on the HD in their entirety?

Would appreciate some insight - I am trying to explain this to someone. I would like to show them some official documentation on this if possible too.

-=ART=-

Quote
Posted : 16/04/2009 1:16 am
kovar
(@kovar)
Senior Member

Greetings,

My EnCase manual states

"Is Deleted displays TRUE if the file is deleted but not emptied from the Recycle Bin."

If you have an EnCase license, you can get the manual in PDF form from the support portal.

-David

ReplyQuote
Posted : 16/04/2009 2:35 am
4n6art
(@4n6art)
Active Member

Kovar

Thank you! We do have a license and the manual, but it's back in the office and I was offsite when I posted this.

Appreciate it.

-=Art=-

ReplyQuote
Posted : 16/04/2009 4:18 am
Share: