Digital Evidence and Computer Crime Forensic Science, Computers and The Internet 2nd Ed [Electronic resources] نسخه متنی

اینجــــا یک کتابخانه دیجیتالی است

با بیش از 100000 منبع الکترونیکی رایگان به زبان فارسی ، عربی و انگلیسی

Digital Evidence and Computer Crime Forensic Science, Computers and The Internet 2nd Ed [Electronic resources] - نسخه متنی

Eoghan Casey

| نمايش فراداده ، افزودن یک نقد و بررسی
افزودن به کتابخانه شخصی
ارسال به دوستان
جستجو در متن کتاب
بیشتر
تنظیمات قلم

فونت

اندازه قلم

+ - پیش فرض

حالت نمایش

روز نیمروز شب
جستجو در لغت نامه
بیشتر
توضیحات
افزودن یادداشت جدید







12.3 Data Recovery

One approach to recovering deleted files and folders on Macintosh systems is to make a clone of the evidentiary drive, connect it to a Macintosh system, and use tools like Norton Utilities, Disk Warrior, or ProSoft Data Rescue.[2] In Figure 12.3 all of the deleted files found by Norton Unerase appear to be fully recoverable. Even when a file has a low chance of recoverability, Norton Unerase may be able to perform a full recovery.


Figure 12.3: Norton Unerase.


It is advisable to try several tools since one may recover more deleted files than others in certain circumstances.

Another approach to recovering deleted files and folder on HFS is to use EnCase. Some deleted files may be listed in the table view and others may be recoverable using E-scripts to carve files from unallocated space. Other carving tools mentioned in previous chapters, such as foremost on Linux, can be used to recover files from unallocated space.

[2]http://www.prosoftengineering.com

/ 280