Notifications
Clear all
10/12/2013 4:20 pm
Tools->Search string in object
jaclaz
Topic starter
16/12/2013 2:16 am
thanks alot for helping ,,, i have found some entries for the file name ,,,,,
but i want to extact all possible information about that file how can i do that in this step ??,,for example dates of modification , is the file has been moved or no ,, something like that >?
thanks in advance
16/12/2013 4:26 am
What do you mean by "some entries for the file name"? Actual MFT records in unallocated or something else?
What you also could do is scan the drive for $LogFile fragments in unallocated, using the signature RCRD. Procedure after that might not be straight forward, but lets take that if you find any.
Page 2 / 2
Prev