Computer Forensics: Recovering Deleted Files With Encase

[ProperJob100]

It's easy peasy to recovery 'deleted data once' but what about recovering original data on a hard drive that has been data wiped clean and written over many times? Can any recovery software do this?

[whereisyourdata]

@ProperJob100

As you say its simple enough to recover deleted files shown; though if your dealing with RAIDs, databases and fragmented data it gets petty complicated. There is no software to recover data. Once its overwritten it is gone (though SSDs have some other issues, but thats hardware rather than software)

[neerujoiya]

hey hellow

hjow get this software i really need this

[whereisyourdata]

@neerujoiya

The best way is to buy it, there is lots of software like this.

[whereisyourdata]

You will need to "add" the USB Drive - see the video on how to image a drive with EnCase you can just add the USB drive rather than the hard drive and you should be all good.

[rydemmc]

How do you mount your usb drive to encase, i have tried to drag and drop the usb drive into encase and it only shows up as single files and it only shows the files that are on the usb drive not the one i have deleted.

[anrilbau]

how to use enCase at windows 7???

jeane@stikom bali

[rydemmc]

where are the deleted files stored in ntfs?

[whereisyourdata]

@rydemmc

A couple of links that should help you:

tinyurlDOTcom/6jfdukt

tinyurlDOTcom/67lr9p5

But, in short they stay where they are until they are overwritten.

[catnip20]

I wonder how EnCase's recovery compares to Recuva & Disk Digger. I know EnCase does a lot more, But If your just wanting file recovery those are two great portable apps that have worked pretty good for me.

[dzf203]

it's good

[Galaxytwix]

right click and unerase dont really work 4 me

[whereisyourdata]

What errors are you getting?

[MrCARC]

i can do this with txt files but when i restore a PDF file and want to open it, it says that is damaged,i guess i'll google it but if anybody know why your help will be apreciated thx

[whereisyourdata]

If you are using EnCase to extract out files and you got a working text file but a PDF files that will not open, then its probably because its not a fully recovered PDF file, and it needs repairing

[NoPain159]

pls link for download.

answer

[whereisyourdata]

Sorry, I don't understand your question? Do you mean a link for EnCase?

EnCase is produced by Guidance Software, its number one on Google if you look for it, and its the most popular tools in the forensics industry. It costs around £3,000, but there are lots of "dubious" versions of EnCase 4 (the current release is EnCase 6) on Torrent

[NoPain159]

i need download link for encase,need a free version,if it exist..

[whereisyourdata]

There is no such thing as a free legal version of EnCase. Encase requires a dongle to work, so even if you were provided with the software it would not work. There are illegal versions on torrent, where the security has been cracked (that is for EnCase 4, 5 and 6 have not been cracked).