New
#11
You need low level access- try a file recovery program like Recuva.
You need low level access- try a file recovery program like Recuva.
You should probabaly be using a program called FTK Imager to create an image of your hard-drive. Then analysing this image using such software as EnCase or FTK.
Here is a video of how to manually locate the NTFS metafiles:
Forensics: What is $Boot? « Where is Your Data?
Thanks Lipchen. That's a nice detailed explanation you pointed me to.