Notifications
Clear all
24/07/2008 3:15 pm
Discussing keeper's questions following data recovery with ideas of what to look for, noahb2868 mentioned about recovering the old partition table etc….
Would keeper want to see what data wiping progs may been used or installed… For instance, what about 'evidence-eliminate' or 'eraser'?
Topic starter
24/07/2008 7:54 pm
What info could the MFT give, in this case ? Relevant at all ???
Would keeper want to see what data wiping progs may been used or installed… For instance, what about 'evidence-eliminate' or 'eraser'?
In this case that doesn't matter (since it didn't happen), but it can be easily done by recovering the registry hives.
Page 2 / 2
Prev