Notifications
Clear all
Topic starter
29/05/2010 12:58 am
Hi all
During drive imaging using FTK Imager, I asked it to export a list of files in CSV format. The columns it creates are
FileName
FullPath
Size
Created
Modified
Accessed
IS DELETED
Does anyone know what causes the IS DELETED column to have a YES entry for a particular file? I show all kinds of paths for the files that have a YES entry - TIF, other temporary areas etc.
Thanks all - have a safe weekend!
-=Art=-
29/05/2010 2:45 am
It means the files $mft or FAT entry is set for reuse but not re-allocated and that the file data on the disk has not been totally overwritten.
EnCase gets its information from the files $mft or FAT entry and displays an icon like a blank no smoking sign for the file.
Topic starter
01/06/2010 11:15 pm
Thanks Neddy.
Much appreciated.
-=A=-