Hi again!
I told you I would comment my progress in this case when I had the time. Well… here I am… and without results!! D
The system under analysis uses a RAID5 configuration with NTFS. I haven't been able to find ANY of the deleted files or folders with EnCase (they aren't present not even as overwritten!!). Anyone knows why these files and folders don't appear? I mean… shouldn't they be present at least marked as "overwritten"?
Thank you, folks
Are you looking at a logical image or physical image? Logical image will not have unallocated space. If your image is physical then at the bottom of the directory tree there should be a "grey" folder named "Lost Files". Additionally, you can right click the drive icon and choose "Recover Folders…"
Nate
Yes, I already knew that but thank you for your advice. I made a physical copy of the HD, so that is why I'm wondering why the files aren't there! The client told me that after the deletion they had recovered a backup copy from the previous day (HP Openview DataProtector), but anyway, it still seem very strange to me that none of the interesting files are there anymore.