CHFI Chapter 5

When a FAT File is deleted - The OS replaces the first letter of the deleted filename with E5H. Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritten, the file can still be recovered. When a NTFS File is deleted - The OS marks the index field in the MFT with a special code. The computer now looks at the clusters occupied by that file as being empty. Until these clusters are overwritten, the file can be recovered Recycle Bin - A place to store files that are marked for deletion. The exceptions are large files and files from removable media. Windows 98 and earlier (FAT) Recycle Bin - - C:Recycled (4GB limit) - Files are named D o x is drive o y is sequence number (0-??) o ext is original extension. - For the first document file deleted on C: drive would be: D Windows 2000, XP, NT (NTFS) Recycle Bin - C:RecyclerS- (based on windows SID) Windows Vista, 7,8, and 10 Recycle Bin - - C:$Recycle.Bin - Files are named $R o y is sequence number o ext is original extension - For the first document file deleted on C: drive would be: $R INFO2 - In Windows newer than Vista and XP, the OS stores the complete path and file or folder name in a hidden file called INFO2. File Recovery Tools for Windows - Recover My Files, EaseUS, DiskDigger, Handy Recovery, Quick Recovery, Stellar Phoenix, Total Recall, Advanced Disk Recovery, Windows Data Recovery Software, R-Studio, Orion File Recovery, Data Rescue PC, Smart Undeleter, DDR Professional, GetDataBack, UndeletePlus, File Scavenger, VirtualLab, Active@UNDELETE, WinUndelete, R-Undelete, Recover4all, Recuva, Active@ File Recovery, Pandora Recovery, Ontrack EasyRecovery, Wise Data Recovery, Glary Undelete, Disk Drill, PhotoRec. Privacy Eraser - an anti-forensic solution to protect the privacy of the user by deleting the browsing history and other computer activities. The software implements and exceeds the US Department of Defense and NSA clearing and sanitizing standards, giving you the confidence that once erased, your file data is gone forever and can never be recovered. Recovering Deleted Partition - - Restart system with Windows install DVD then select repair. When DOS comes up type "fixboot" - Slave the drive to another and try to recover that way - 3rd Party tools like