Notifications
Clear all
Topic starter
20/04/2007 5:53 pm
I have a problem. In imaging a recycler folder, FTK returned 1 more file than EnCase. This file was named '$I30' and it appeared to contain a huge list of deleted files? However im not sure if this correct. Does anyone actually know wat this file does? Thanks
20/04/2007 9:29 pm
A detailed description of $I30 can be found
20/04/2007 10:20 pm
This file was named '$I30' Does anyone actually know wat this file does? Thanks
In EnCase the contents of this file do get attributed to a directory/folder.
The $I30 stream for a folder contains the files that are in it, organized as a b-tree. There is also some slack/deleted information in it!