Hi everyone I am brand new to Forensics Focus and this is my first post! I have a question with a few parts. I am using EnCase 7 and I'm working with a Windows 7 laptop image. I am having a hard time reporting the original file name of files that reside in the recycle bin. I understand the details of the $I and $R files but I cant seem to find a way to report the original file name without copying and pasting them individually. I have a few hundred files in the recycle bin and I am trying to find a way to easily report the original file names and the date / time they were deleted.
Please and Thank You!
I believe if you bookmark the $R you can include metadata in the section within your report that will include all the $I information.
Take a look at your view pane when you select the $R file. Unless you changed the template you used, whatever information appears in the View pane report tab, you should get in the report.
Thank You!