Deleted files

From SleuthKitWiki
Revision as of 20:36, 26 October 2010 by Carrier (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Deleted files are those that have been deleted by a user, but whose content can still be recovered. There are many different levels of deleted files. Some still have names that can point to file content in data units. Others have no name, but still have the file content layout. Others have no file system-level information, but can be recovered using carving techniques.

Retrieved from "https://wiki.sleuthkit.org/index.php?title=Deleted_files&oldid=499"