All,
I need to acquire just a user directory/folder under windows, with all the associated files both deleted/slackspace and allocated. I do not want to image the entire drive since all I am interested in is the "c\documents & setting." Logical acquisition using FTK won't give me the data in slack space deleted by the user. Is there any way to recover files deleted by a user without imaging the whole disk? Are there tools that can do this?
Sorry for this question. In theory, I don't think it is possible to recover deleted files, without a full-blown drive acquisition. Then again, I want to be absolutely sure.
Thanks in advance – ii (i2
Hi,
you're right, you can't be sure to have all data which once were in one sinlge directory when you just look at the directory itself, you need to image the whole disk.