File Recovery

In this module and the next, you will:

Use a DFR tool to recover deleted files in a hard disk or thumb drive
Compare the outcome of different DFR mechanisms (i.e., metadata-based mechanism vs. file carving)
Demonstrate the difference in outcomes of the recovery process for different file types
Explain how DFR mechanisms work under the hood

Download and read these slides to start learning how to recover deleted files

Here also are the files for each lab mentioned in the slides

Labs.zip

The file below is for instructors to help organize the labs

Lab Prep.txt

Understand formatting and how to uncover file signatures

You may now be wondering:

When the files were just deleted in the USB drive but the USB drive was not formatted, why is Autopsy successful in recovering all the deleted files?
When the USB drive was quick-formatted, why could not Autopsy recover a text file but could recover a pdf file?

We will explore these and more in the

next module