armstrong wrote:
Thanks!
Also, talked to him a little today and apparently the only program he used to hide the file was command prompt. Not sure if that means anything and not really sure how to use command prompt to find files but any insight would be appreciated
At a guess, that could mean he just made it an alternate data stream. Opening your hard disk in FTK imager would probably show them up, not sure if there is an easy way to filter them though.
↧