File Recovery
In this module and the next, you will:
- Use a DFR tool to recover deleted files in a hard disk or thumb drive
- Compare the outcome of different DFR mechanisms (i.e., metadata-based mechanism vs. file carving)
- Demonstrate the difference in outcomes of the recovery process for different file types
- Explain how DFR mechanisms work under the hood
Getting Started
Download and read these slides to start learning how to recover deleted files
File Recovery Part 1.pdfHere also are the files for each lab mentioned in the slides
Labs.zipThe file below is for instructors to help organize the labs
Lab Prep.txt
You may now be wondering:
- When the files were just deleted in the USB drive but the USB drive was not formatted, why is Autopsy successful in recovering all the deleted files?
- When the USB drive was quick-formatted, why could not Autopsy recover a text file but could recover a pdf file?
We will explore these and more in the
next module