i have extracted a HP dv9700 with two 160GB HDD. The second is empty, only a few files and an old backup….
on the first is Windows Vista, but some folders like pictures are only "links". With EnCase i found a lot of interesting data in allocated spaces….with FTK Imager i found "unallocated space" with folder like "0001400", "00118575"…. in this folder thousends of file with name like "06242854"….
This file are reable, but i am not sure with data is inside….is there some tool to extract the right extension? On mac or PC?
Or is there some other idea to extract the data?
You could try a file carver like PhotoRec which will attempt to add the correct extension.
You could try a file carver like PhotoRec which will attempt to add the correct extension.
Yep )
Or, since the files are readable, you could pass the actual files to TriD
http//
?
jaclaz
Thanks, TriD is cool….;)