Deleted documents f...
 
Notifications
Clear all

Deleted documents from formatted drive

13 Posts
7 Users
0 Reactions
988 Views
noahb2868
(@noahb2868)
Trusted Member
Joined: 17 years ago
Posts: 50
 

What about restoring the partition? You might be able to get everything back that way. If you are using an e01 file, then you may have Encase or another analysis tool that can search for old MFT records and partitions. Try searching for NTFS if the drive was previously formated that way. It may jsut work….


   
ReplyQuote
(@bluedragon)
Trusted Member
Joined: 18 years ago
Posts: 60
Topic starter  

Thanks mscotgrove, I will try your s/w.

noahb2868, hoe do I search for old MFT records and paritions in EnCase? Once I find it, I do I retrieve the files that I want?

And what you mean by "searching for NTFS"? yes, the drive was previously formatted.


   
ReplyQuote
(@jgoss)
Trusted Member
Joined: 18 years ago
Posts: 59
 

Why should it make a difference if it was a quick or full format? Theres no difference between the two, a full format only checks each sector to see if its bad or not…a quick format skips that bit.


   
ReplyQuote
Page 2 / 2
Share: