Hi, i'm new to this forum and i'm new to forensic.
Some data on my pc were accidentally deleted and i'd like to restore it.
I tried some tool and finally tried with autopsy.
I found some deleted images but i can view only some of them.
I read the wiki and i read that files marked with bright red are unallocated files and it would be more easy to recover this file but i didn't succeed to recover.
The fles marked with darker red , instead, have a meta data structure that has benn reallocated and whould be more difficult but i recovered somne of them.
I found also some images that i think are corrupt. In fact when i click on them the browser show me a page with some text.
What can i do in this case? it is very very importnat to me.
I searched on the web for hours but i don't know how to go on.
Hope you can help me.
Thank you, bye.
If data has been even partially overwritten, the specific file can't be recovered in full..
if it comes to images you may be able to recover them partially.
if autopsy shows you the file as text strings or hex probably it can't find the whole image down to the footer,
try to export it and open it with some image manipulation progrem (like gimp) maybe a part of the image is still visible.
next you can also try to use a carving software like photorec to try to carve out the images that have lost their reference in the filesystem but are still there.