This might be a really silly question, but when a file is recovered from unallocated clusters is there any information in the file or relating to the file that will be missing?
I'm pretty new to this and I'm trying to finish an assignment about data recovery from hard drives. When I try internet searches for this particular question, most of the websites are just trying to sell me their data recovery software which isn't helpful! Any help here would be greatly appreciated )
I can't think of a meaningful answer which generalizes well - so perhaps you could offer some further specifics. To begin with, which file system are you examining?
I've been examining FAT. The question which I have been asked to answer is a general one though. All I've been able to come up with is that there might not be a file system structure when you recover a file. I can't think of anything else that might be missing s
Large chunks of the file may be missing if it has be partially overwritten by the operating system.
Metadata/MAC Times may also be missing, however this is not true in all cases.
An interesting article I read some time ago http//
Hope that helps a bit.
I believe what the question is attempting to discern is that while you may recover the file, you _may_ not have any corresponding file system metadata associated with it (owners, timestamps, security, data runs etc).
Thank you! I think thats what I was looking for, that really helps a lot. )