Notifications
Clear all
Topic starter
16/06/2008 11:39 pm
Is it possible to retrieve metadata about a file that has been deleted, or is it all dependent on if certain areas of the file still exist?
17/06/2008 2:40 am
Depends on the file format and metadata you're referring to…
Topic starter
17/06/2008 3:07 am
a microsoft word document that has been deleted, but to determine the last accessed time
17/06/2008 7:07 am
There are a couple of ways to do this…
One is Registry analysis…if you know the name of the file, there are a number of locations that you can look in for this info.
There's also MFT entries if the file was deleted, but it's MFT entry hasn't been overwritten.
Also, recover the file and extract the OLE/structured storage metadata.