4 years ago

Comment has been collapsed.

no log as far as i know but i've used recuva when i deleted something on accident

4 years ago
Permalink

Comment has been collapsed.

Very little hope for recovering files from ancient times. Best chances are if you stop using the HDD right away after deleting so they don't get overwritten by anything.

4 years ago
Permalink

Comment has been collapsed.

By default no, only if you manually enable file history.

4 years ago
Permalink

Comment has been collapsed.

It's very easy to recover deleted files, if:

  • power off instantly your computer (with power-off on the computer power supply, not closing your system!) after mistaken delete
  • any change on disk after file deletion can make recover impossible

Next:

  • run linux from CD / usb stick
  • mount this partition as RO (read only)
  • use soft like testdisk
  • copy recovered file into other media
  • repair file structure of OS (your system will do it itself)

I recovered successfully files or even entire partitions (also from physically damaged disks - of course, not 100%).

4 years ago*
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 11 months ago.

4 years ago
Permalink

Comment has been collapsed.

Are you interested only in seeing if something was deleted or actually recovering it? If it's the former, generally yes. There is something called the NTFS USN Journal that stores file operations that have taken place on an NTFS drive. It's reasonably difficult to tamper with which makes it a great resource for digital forensics.

If you were interested in only seeing what files were deleted and not recovering them, let me know. I'll see if I can't find a beginner-friendly tool for parsing the USN Journal (the tools are generally geared toward security analysts).

4 years ago
Permalink

Comment has been collapsed.

Sign in through Steam to add a comment.