Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

General Discussion: Recovery of a text file with damaged MFT (zero sized file)

$
0
0
damaged_mft wrote: note: The EASEUS file is 5% smaller than the .bin image created by DMDE. So either the EASEUS file is compressed, or the non-allocated space has been left out. If it is compressed, then it might contain all the original bytes after all. Yes, both are likely possibilities, though normally a compressed image would have a higher compression rate, and the 5% should mean (in the case of a skipped-unallocated) that the disk was at the time almost full to the brim. It is also possible that it is a "skipped-unallocated" with some form of header/metadata. But in any of the three cases restoring the image is the most sensible thing to do. (when you will have available a suitable media). jaclaz

Viewing all articles
Browse latest Browse all 20107

Trending Articles