View Single Post
  #2 (permalink)  
Old 11-01-2006, 03:06 AM
GDH GDH is offline
Administrator
 
Join Date: Feb 2005
Posts: 2,715
Default Data Recovery

Hi,

You are right about how the Recycle Bin works. When you run Recover My Files, in the drive selection window, include the Recycle Bin Folder in the search (technically these files may not be recognised by the PC as being deleted so you need to make sure by searching the active files in this folder).

You will find that files in the Recycle Bin will be recovered with their DC... file name. It is possible to recover the INFO2 file and decode its contents. It is rather technical and you may need assistance from a Computer Forensics technician. Even once decoded you will end up renaming the files by hand.

Because of the situation you describe you may wish to think about taking a forensic image of the drive. The most common software used by computer forensic technicians for this purpose is called EnCase (contact me directly for more details). Once you take the image you will preserve a read only sector copy of the drive which cannot be changed - so you wont make things worse and can protect your integrity if the matter gets ugly at a later stage.

Once you have taken an forensic image it can be mounted using Mount Image Pro from www.mountimage.com and then you can run Recover My Files and other tools on the mounted image.
__________________
Graham Henley
GetData Support Staff
http://www.getdata.com
http://www.recovermyfiles.com
Reply With Quote