PhotoRec is a file carving tool that is widely used by digital forensic examiners. This tool is even built into the previously mentioned digital forensic platform, Autopsy, as a module. PhotoRec can recover a diverse range of file types (more than 480 file formats), but if you think this will not be enough, you can add your own custom signatures, which will help the tool to recover even more data.
- Preface
- Digital Forensics and Evidence Acquisition
- Windows Memory Acquisition and Analysis
- Windows Drive Acquisition
- Windows File System Analysis
- Windows Shadow Copies Analysis
- Windows Registry Analysis
- Main Windows Operating System Artifacts
- Introduction
- Recycle Bin content analysis with EnCase Forensic
- Recycle bin content analysis with Rifiuti2
- Recycle bin content analysis with Magnet AXIOM
- Event log analysis with FullEventLogView
- Event log analysis with Magnet AXIOM
- Event log recovery with EVTXtract
- LNK file analysis with EnCase forensic
- LNK file analysis with LECmd
- LNK file analysis with Link Parser
- Prefetch file analysis with Magnet AXIOM
- Prefetch file parsing with PECmd
- Prefetch file recovery with Windows Prefetch Carver
- Web Browser Forensics
- Email and Instant Messaging Forensics
- Windows 10 Forensics
- Data Visualization
- Troubleshooting in Windows Forensic Analysis
File carving with PhotoRec
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.