Can somebody explain how this feature works in EnCase? I know how to run it, but I need to be able to explain to the defense how EnCase does it. Thanks in advance!
The quick and dirty explanation is that EnCase scans the entire volume for metadata associated with files and directories which might be outside the MFT (in unallocated space) and then attempts to rebuild these using what information it can find.
This can be particularly useful if the user reformatted without wiping since data from the old MFT would persist.
Greetings,
I don't have a copy of EnCase handy, but I believe the Recover Folders is an EnScript. If so, you could read the code and see exactly what it is doing.
Also, Guidance should have a vested interest in helping you explain this in court. Have you tried calling them up, explaining your situation, and asking if they have any documentation that could help?
-David