This document will detail how you can recover lost or, deleted files during an incident or, if in the event you are facing a forensics. Topics discussed will be: 1) Analyzing the file system for files that were deleted, 2) Determining the date/time of a deleted file and lastly 3) The recovery of said files and or artifacts. Please note, dates and times within this article are discussed if in the event a legal proceeding is taking place and a cease notice has been delivered. This is to prove or disprove that a suspect system has been modified AFTER a cease notice was sent. You can also utilize this article if you are in need of recovering files that have been lost or damaged.

Register to read more …