Recovering deleted ...
 
Notifications
Clear all

Recovering deleted file from Network Share

2 Posts
2 Users
0 Reactions
504 Views
(@sundaresan)
New Member
Joined: 11 years ago
Posts: 1
Topic starter  

Hello,

We are working to recover the critical excel 2010 file was deleted from the network share, . The network drive in server is SAS HDD configured with RAID 6 and logical partition size of the drive is 8Tb. Unfortunately the shadow copies are not enabled in the server no backups

Firstly, The server network share is put off to avoid file overwritten. Installed encase forensics V7.10
Loaded the live server physical drive in the encase. And selected logical drive 8TB for evidence processing . No deleted entries found in "Recover lost folders". Just waiting for the file carving to finish.

The Evidence processor is enabled with following option
1. Recover lost folders
2. Hash analysis
3. File carving ( With only Microsoft spreadsheets enabled)

I started the the encase evidence processor 5 back . Still encase works on the last module task to do file carving . No clue how long does it takes.

Folks please advise is there anyways we can recover the file

Regards,

R.Sundaresan


   
Quote
nightworker
(@nightworker)
Estimable Member
Joined: 16 years ago
Posts: 134
 

don not use encase for recovery use r-studio and increase ram size due to big data and scan it


   
ReplyQuote
Share: