1 / 24

Data Recovery/Discovery

Data Recovery/Discovery. Files Deleted Files Text Searches Slack Space Free Space Lab. Files on the Drive. List all the files on the drive WinHex can show only one folder at a time Import file list into Excel Sort by file extension. Open Floppy Image. Interpret Image File as Disk.

amiel
Download Presentation

Data Recovery/Discovery

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Data Recovery/Discovery • Files • Deleted Files • Text Searches • Slack Space • Free Space • Lab

  2. Files on the Drive • List all the files on the drive • WinHex can show only one folder at a time • Import file list into Excel • Sort by file extension

  3. Open Floppy Image

  4. Interpret Image File as Disk

  5. “Crtl A” Select All Files and Folders

  6. Export File List

  7. Choose the Fields to Export To choose the fields that you want hold the “Ctrl” key down and click on the desired fields

  8. Pertinent Data • Name • Description • Extension (file type) • Path • Size • MAC date/times

  9. Save in your Case Folder

  10. Open it in Excel • It may open it automatically • If not • Go to your case folder • Start Excel • File -> Open • Find your Case Folder • Select All files • Open the .txt file

  11. All Files

  12. Run through formatting options

  13. Run through formatting options

  14. Run through formatting options

  15. Make it Pretty • Landscape format • Smaller font • Expand columns to show full date time • Etc.

  16. Pretty

  17. Description Column • Note an assessment of recoverability • Find the file in WinHex • “Recover/Copy” • A deleted file has been recovered

  18. Deleted Files • With your spreadsheet you know what deleted files you can recover • Recover them

  19. Text Searches • Search the entire disk/image for varioous words • WinHex returns a list of hits • You have look for the context on the words and determine if it is of probative value • Select all hits and delete to clear the search list

  20. Simultaneous Search

  21. Enter Search Terms

  22. High light a search hit

  23. Lab Assignment • List of files organized by file extension • Highlight recoverable deleted files • Recover the files and comment on their relevance to charges of cat porn • Select keywords and search for them.

More Related