Locating $mft

Page 2 of 2 FirstFirst 12

  1. Posts : 5,056
    Windows 7 x64 pro/ Windows 7 x86 Pro/ XP SP3 x86
       #11

    You need low level access- try a file recovery program like Recuva.
      My Computer


  2. Posts : 1
    Windows 7 64-bit
       #12

    Hello


    You should probabaly be using a program called FTK Imager to create an image of your hard-drive. Then analysing this image using such software as EnCase or FTK.

    Here is a video of how to manually locate the NTFS metafiles:
    Forensics: What is $Boot? « Where is Your Data?
      My Computer


  3. mjf
    Posts : 5,969
    Windows 7x64 Home Premium SP1
    Thread Starter
       #13

    Thanks Lipchen. That's a nice detailed explanation you pointed me to.
      My Computer


 
Page 2 of 2 FirstFirst 12

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 07:30.
Find Us