|
|
Article DetailsThis article covers the WindowsMail.MSMessageStore database used by Windows Mail. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly gather all file signatures (file headers) from all files within a case for review and/or research purposes. This article will use the tools Header Grab Advanced, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly view and export search results from Winhex POS files to CSV format. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly search for and detect any hidden worksheets present within a Microsoft Excel Workbook (xls and xlsx). This article will use the tools XLS Worksheet Detect Free and commercial versions, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to batch preview URL files used to store favorites information in Internet Explorer. This article will use the tool URL Previewer, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
- Active Links: 10
- Pending Links: 3
- Todays Links: 0
- Total Articles: 16
- Total Categories: 4
- Sub Categories: 0
Vista Recycle Bin Records - How to extract information |
| Date Added: October 03, 2009 06:39:40 PM |
| Author: admin |
| Category: Documents |
Microsoft Vista employs a different method of keeping track of individual files that have been recycled, for each file moved to the recycle bin by the operating system a record is created (as individual file)*. These records are typically identified as being 544 bytes in size, the first character of the file record will be '$' and the file extension of the record will be the same the deleted file.
Above example showing recycle bin records, each 544 bytes in size. Vista Recycle Bin Reader, part of Simple Carver Suite is a forensic software utility designed to extract information relating to deleted files within the Recycle Bin from the Vista Operating System. It is capable of interpreting the recycle bin records from the Vista OS and show what has been deleted (original filename and path) and when (date/time information). Vista Recycle Bin Usage:
Click HERE for Vista Recycle Bin Reader
* for deleted folders a folder is created. |
