Notifications
Clear all
Topic starter
25/07/2013 9:43 am
Hi,
i have some questions regarding Recycle Bin.I am using Encase 6.19.7.
When I extract the INFO2 record from the Recycle Bin of the suspect, there is only the information of one file inside. However, I can still see there are a lot of other files inside the Recycle Bin, e.g DC1.doc, DC2.xls. (Encase shows these files as deleted)
1) Does this show that the someone has emptied the Recycle Bin?
2) The deleted files in the Recycle Bin - these files were inside the Recycle Bin before it is emptied?
3) Is there any way to retrieve the deleted files with their original filenames?
Thanks.
Regards
25/07/2013 1:42 pm
What OS are you examining?