| <<< Disk Geometry and Partitions | Index | Signature Analysis >>> |
Click on the volume such as C: in the Tree view.
Right-click and choose Recover Folders.
While recovery process is in progress, don't do anything else -- let it finish.
Be sure to Save the case after recovery is complete.
EnCase searches unallocated space for
on NTFS volume -- $MFT entry records and rebuilds the file system content from there.
on FAT volume -- directory entries, designated by "." and "..", followed by file and directory entries.
See EnCase Lesson 23, pages 238-240 for details.
| <<< Disk Geometry and Partitions | Index | Signature Analysis >>> |