Walkthrough: Carving With Belkasoft Evidence Center

by Yuri Gubanov, Danil Nikolaev & Igor Mikhailov © Belkasoft Research

Carving is an irreplaceable technique widely used in data recovery and digital forensics. By using carving, we essentially perform a low-level scan of media for various artifacts, looking for Read more

Shrinking the gap: carving NTFS-compressed files

First published October 2009

Recovering deleted NTFS-compressed files

By Joachim Metz
Hoffmann Investigations
www.hoffmannbv.nl

1.0 Joachim Metz September 2, 2009 Initial version.

Summary

An important part of digital forensic investigation is the recovery of data, particulary files. The recovery of

Read more