data recovery/discovery files deleted files text searches slack space free space lab
TRANSCRIPT
![Page 1: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/1.jpg)
Data Recovery/Discovery
• Files
• Deleted Files
• Text Searches
• Slack Space
• Free Space
• Lab
![Page 2: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/2.jpg)
Files on the Drive
• List all the files on the drive
• WinHex can show only one folder at a time
• Import file list into Excel
• Sort by file extension
![Page 3: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/3.jpg)
Open Floppy Image
![Page 4: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/4.jpg)
Interpret Image File as Disk
![Page 5: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/5.jpg)
“Crtl A” Select All Files and Folders
![Page 6: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/6.jpg)
Export File List
![Page 7: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/7.jpg)
Choose the Fields to Export
To choose the fields that you want hold the “Ctrl” key down and click on the desired fields
![Page 8: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/8.jpg)
Pertinent Data
• Name
• Description
• Extension (file type)
• Path
• Size
• MAC date/times
![Page 9: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/9.jpg)
Save in your Case Folder
![Page 10: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/10.jpg)
Open it in Excel
• It may open it automatically• If not
– Go to your case folder– Start Excel– File -> Open– Find your Case Folder – Select All files– Open the .txt file
![Page 11: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/11.jpg)
All Files
![Page 12: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/12.jpg)
Run through formatting options
![Page 13: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/13.jpg)
Run through formatting options
![Page 14: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/14.jpg)
Run through formatting options
![Page 15: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/15.jpg)
![Page 16: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/16.jpg)
Make it Pretty
• Landscape format
• Smaller font
• Expand columns to show full date time
• Etc.
![Page 17: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/17.jpg)
Pretty
![Page 18: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/18.jpg)
Description Column
• Note an assessment of recoverability
• Find the file in WinHex
• “Recover/Copy”
• A deleted file has been recovered
![Page 19: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/19.jpg)
Deleted Files
• With your spreadsheet you know what deleted files you can recover
• Recover them
![Page 20: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/20.jpg)
Text Searches
• Search the entire disk/image for varioous words
• WinHex returns a list of hits
• You have look for the context on the words and determine if it is of probative value
• Select all hits and delete to clear the search list
![Page 21: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/21.jpg)
Simultaneous Search
![Page 22: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/22.jpg)
Enter Search Terms
![Page 23: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/23.jpg)
High light a search hit
![Page 24: Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab](https://reader030.vdocuments.us/reader030/viewer/2022032600/56649d995503460f94a838f6/html5/thumbnails/24.jpg)
Lab Assignment
• List of files organized by file extension
• Highlight recoverable deleted files
• Recover the files and comment on their relevance to charges of cat porn
• Select keywords and search for them.