Notifications
Clear all
Topic starter
28/04/2022 3:11 pm
Hi, is there any chance recover a replaced file with the same name using FTK or EnCase?
04/05/2022 1:36 am
It's probably gone forever, unless you have a backup.
Depending on the file type and other factors (File system, file size, O/S, amount of time past since deletion, etc..) there is a small chance you can 'carve' the file.
Also depends on how the file was replaced. Deleted and recreated, or opened and overwritten.
Also check Volume Shadow Copies.
Â