I'm analyzing several drives which have hundreds of graphic files, jpgs, gifs, bmps and mgps. The files are not deleted but are truncated. For example, one directory has hundreds of gifs, all of which are only 73 bytes. Would a file wipe utility cause this situation? I believe the suspect attempted to cover his tracks.
Is it a FAT or NTFS drive?
Do the directory entries show the correct lengths?
you say the .gif are 73 bytes, how bout others? are all the .bmp the same, if so what size, same for .jpg etc. OR is every graphic file 73?
Bill
Depends on the directory…I see a lot of stuff like this in temp internet files…
It's NTFS and no, not *all* graphic files are that size. I don't have the data in front of me so I can't tell you what directory they were in. I'll check when I'm back in the office.