Can anyone tell me how to finds out if proogram (exe) files were deleted from a hard drive? I have FTK and only deleted "files" will show on the menu board.
My next guess would be the registry for this information?
Any help or input appreciated.
Mark
I'm unfamiliar with the interface of FTK so excuse my lack of knowledge, but as an .exe is a file wouldn't it also show up on that 'menu board' if all that menu board does is display reconstructed deleted files from any unallocated space on the image?
TMD more info would help give a better idea on how you can be helped here.
Can you expand on your first post please.
I believe the first post answered my question. EXE file should show up under deleted section of FTK.
I will try that myself later on.
Thanks all