Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20112

General Discussion: Deleted truecrypt container

$
0
0
If I load the MFT file into an MFT analyser it tells me that the resident flag is set, so MFT thinks the file is resident within the MFT entry, yet still 0 bytes long. Is this consistent with a situation where the data attribute is pointing to another MFT record? Hate to be obtuse but I've spent a few hours wrapping my head around MFT flags and am not totally confident of my skills. Here's the raw hex for the MFT entry for this file, if it helps. Code:: 46 49 4C 45 30 00 03 00 E9 EC 00 B9 00 00 00 00 04 00 01 00 38 00 00 00 50 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 04 00 00 00 7C 3E 00 00 96 0C 00 00 00 00 00 00 10 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 18 00 00 00 22 F6 AD 12 D2 5C CD 01 04 B7 02 D7 D8 5C CD 01 7E EC BC 89 DA 5C CD 01 22 F6 AD 12 D2 5C CD 01 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 01 00 00 00 00 00 00 00 00 00 00 78 8F 40 1A 00 00 00 00 30 00 00 00 68 00 00 00 00 00 00 00 00 00 02 00 4A 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 22 F6 AD 12 D2 5C CD 01 22 F6 AD 12 D2 5C CD 01 22 F6 AD 12 D2 5C CD 01 22 F6 AD 12 D2 5C CD 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 04 03 64 00 61 00 74 00 61 00 00 00 00 00 00 00 80 00 00 00 48 00 00 00 01 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 FF FF FF FF 82 79 47 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 0C

Viewing all articles
Browse latest Browse all 20112

Trending Articles