Home Webinars The Magic of Raw Data Carving

The Magic of Raw Data Carving


You have used all of the utilities in your expensive forensic suite, and other programs to carve files from unallocated file space. Do you think you have found everything? If you answered yes, guess again. The typical way that carving utilities are able to recover deleted data automatically is through file header and footer identification, and this recovers an intact file. In other words, a file has been deleted, but not yet overwritten by new data. What happens if part of the deleted file is now overwritten, but some of the old data still exists? What about file fragments from slack space? This informative and easy to follow lecture show attendees how they can manually carve data from unallocated file space, and also what to do with it so that it is useful. In this webcast Kevin Ripa also talks about data recognition. This means being able to not only see the search hit but identify the context in which it is being seen. Drawing on case studies and real-world examples from his lab, you can immediately apply these techniques once you return to yours.

Load More Related Articles
Load More In Webinars
Comments are closed.