Viewing deleted files in the Trash folder
Posted by Jack H. Ward on 09 July 2019 11:10 AM

The Electronic Evidence Examiner allows you to view all deleted files in the Trash folder. The Trash folder is added to the root of the evidence and contains all restored data that was deleted from the evidence. The Trash folder can only be added to the disk or disk image evidence.

To add the Trash folder to the NTFS root, you need to enable this option while adding the disk as evidence.

The Trash folder content is displayed in the Data View pane.

The Trash folder can contain two types of data:

  • Deleted folders: These are stored as subfolders of the Trash folder and can be viewed as its subnodes in the Case Content pane and in the Data View After double-clicking these folders, their contents (files and subfolders) are displayed in the Data View pane.
  • Deleted files: The files that were deleted separately are restored in the Trash folder root.

Deleted files and folders are marked with a red 'X' icon. The contents of the deleted files can be viewed in the Hex and Text viewers.

(0 vote(s))
Not helpful

Comments (0)