Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
485
Views
Topic starter
25/07/2011 3:04 am
How does one explain when a deleted jpeg image is recovered the original file name and date & time associations are gone? Thanks
25/07/2011 3:44 am
When the MAC deletes a file it also clears down the catalog entry (with zeros). The file data may exist, but no catalog entry, hence no name, dates, attributes etc.
On a PC, the MFT (or FAT) entry is tagged as deleted, and the information remains, and often the the file can then be recovered - if not overwritten before recovery time.