SlideShare a Scribd company logo
1 of 3
Chapter 8
Finding Lost Files
1
Old Files Never Die
Deleting a file doesn’t erase data
Even a wiped file may leave behind artifacts
Remnants of old files may remain in slack space or unallocated
space
Temporary files may still exist or be recoverable
Some files aren’t deleted, but rather intentionally hidden
OS File Recovery
Deleting a file sends it to the “Trash” or “Recycle Bin”
File is simply renamed and moved to a hidden folder
Deleting the file from Recycle marks the space used by the file
as available (but does not erase data)
Using a WIPE utility overwrites the data on the medium with
random characters
What is Slack Space?
Hard disks are divided into clusters of 4 to 32KB
If a file does not fill a cluster, the remainder of the cluster is
not overwritten, nor is it available
Slack space also exists between partitions on a physical disk
Utilities such as Slacker can harness all this space into a usable
file system
What is Unallocated Space?
When a disk is formatted, each cluster is identified and mapped
When a file is created or copied to the system, the file system
marks the clusters it occupies as “allocated”
When a file is removed from Recycle, the clusters aren’t erased,
but merely marked as “unallocated”
Unallocated space can hold a lot of data
Recovering Deleted Files
Specialized utilities read the file system metadata and identify
clusters where files once lived
If the space has not been overwritten, the files can be recovered
intact
Mark space as allocated
Give the file a new name
Disk editing utilities allow the residual data from partially
overwritten files to be copied to a new file
Data Carving
Files in unallocated space can be retrieved by “data carving”
All bits stored on the medium beginning with a file header and
going through to an end of file marker are copied to a new file
Few utilities can salvage files stored on noncontiguous clusters
Data Carving Tools
Carver
Foremost
Scalpel
Chapter 8Finding Lost Files1Old Files Never Die.docx

More Related Content

Similar to Chapter 8Finding Lost Files1Old Files Never Die.docx

Chapter07 Advanced File System Management
Chapter07      Advanced  File  System  ManagementChapter07      Advanced  File  System  Management
Chapter07 Advanced File System Management
Raja Waseem Akhtar
 
Management file and directory in linux
Management file and directory in linuxManagement file and directory in linux
Management file and directory in linux
Zkre Saleh
 
Microsoft Windows XP/OS Chapt03
Microsoft Windows XP/OS Chapt03Microsoft Windows XP/OS Chapt03
Microsoft Windows XP/OS Chapt03
blusmurfydot1
 
Chapter06 Managing Disks And Data Storage
Chapter06      Managing  Disks And  Data  StorageChapter06      Managing  Disks And  Data  Storage
Chapter06 Managing Disks And Data Storage
Raja Waseem Akhtar
 

Similar to Chapter 8Finding Lost Files1Old Files Never Die.docx (20)

Learn about the File Concept in operating systems ppt
Learn about the File Concept in operating systems pptLearn about the File Concept in operating systems ppt
Learn about the File Concept in operating systems ppt
 
C) ICT Application
C) ICT ApplicationC) ICT Application
C) ICT Application
 
Chapter07 Advanced File System Management
Chapter07      Advanced  File  System  ManagementChapter07      Advanced  File  System  Management
Chapter07 Advanced File System Management
 
Aix 400
Aix 400Aix 400
Aix 400
 
File system interfacefinal
File system interfacefinalFile system interfacefinal
File system interfacefinal
 
The windows hierarchy
The windows hierarchyThe windows hierarchy
The windows hierarchy
 
Windowsforensics
WindowsforensicsWindowsforensics
Windowsforensics
 
file management_part2_os_notes.ppt
file management_part2_os_notes.pptfile management_part2_os_notes.ppt
file management_part2_os_notes.ppt
 
CIT173_Ch15_Mnstr_23.pdf
CIT173_Ch15_Mnstr_23.pdfCIT173_Ch15_Mnstr_23.pdf
CIT173_Ch15_Mnstr_23.pdf
 
Technical Presentation
Technical Presentation Technical Presentation
Technical Presentation
 
file management_osnotes.ppt
file management_osnotes.pptfile management_osnotes.ppt
file management_osnotes.ppt
 
Management file and directory in linux
Management file and directory in linuxManagement file and directory in linux
Management file and directory in linux
 
Intake 37 11
Intake 37 11Intake 37 11
Intake 37 11
 
Operating Systems - Implementing File Systems
Operating Systems - Implementing File SystemsOperating Systems - Implementing File Systems
Operating Systems - Implementing File Systems
 
Microsoft Windows XP/OS Chapt03
Microsoft Windows XP/OS Chapt03Microsoft Windows XP/OS Chapt03
Microsoft Windows XP/OS Chapt03
 
Unit ivos - file systems
Unit ivos - file systemsUnit ivos - file systems
Unit ivos - file systems
 
File Management
File ManagementFile Management
File Management
 
File Management
File ManagementFile Management
File Management
 
File Management.ppt
File Management.pptFile Management.ppt
File Management.ppt
 
Chapter06 Managing Disks And Data Storage
Chapter06      Managing  Disks And  Data  StorageChapter06      Managing  Disks And  Data  Storage
Chapter06 Managing Disks And Data Storage
 

More from jeffsrosalyn

Problem 8-2B(a) Journalize the transactions, including explanation.docx
Problem 8-2B(a) Journalize the transactions, including explanation.docxProblem 8-2B(a) Journalize the transactions, including explanation.docx
Problem 8-2B(a) Journalize the transactions, including explanation.docx
jeffsrosalyn
 
Problem 14-4AFinancial information for Ernie Bishop Company is pre.docx
Problem 14-4AFinancial information for Ernie Bishop Company is pre.docxProblem 14-4AFinancial information for Ernie Bishop Company is pre.docx
Problem 14-4AFinancial information for Ernie Bishop Company is pre.docx
jeffsrosalyn
 
problem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docx
problem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docxproblem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docx
problem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docx
jeffsrosalyn
 
Problem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docx
Problem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docxProblem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docx
Problem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docx
jeffsrosalyn
 
Problem 1-4A (Part Level Submission)Matt Stiner started a delivery.docx
Problem 1-4A (Part Level Submission)Matt Stiner started a delivery.docxProblem 1-4A (Part Level Submission)Matt Stiner started a delivery.docx
Problem 1-4A (Part Level Submission)Matt Stiner started a delivery.docx
jeffsrosalyn
 
PROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docx
PROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docxPROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docx
PROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docx
jeffsrosalyn
 
Problem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docx
Problem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docxProblem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docx
Problem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docx
jeffsrosalyn
 
Problem 1-2A (Part Level Submission)On August 31, the balance sh.docx
Problem 1-2A (Part Level Submission)On August 31, the balance sh.docxProblem 1-2A (Part Level Submission)On August 31, the balance sh.docx
Problem 1-2A (Part Level Submission)On August 31, the balance sh.docx
jeffsrosalyn
 
Problem 1-2A (Part Level Submission)On August 31, the balance shee.docx
Problem 1-2A (Part Level Submission)On August 31, the balance shee.docxProblem 1-2A (Part Level Submission)On August 31, the balance shee.docx
Problem 1-2A (Part Level Submission)On August 31, the balance shee.docx
jeffsrosalyn
 
Prior to engaging in this discussion, read Chapters 10 and 11 in y.docx
Prior to engaging in this discussion, read Chapters 10 and 11 in y.docxPrior to engaging in this discussion, read Chapters 10 and 11 in y.docx
Prior to engaging in this discussion, read Chapters 10 and 11 in y.docx
jeffsrosalyn
 
Primary Task Response Within the Discussion Board area, write 300.docx
Primary Task Response Within the Discussion Board area, write 300.docxPrimary Task Response Within the Discussion Board area, write 300.docx
Primary Task Response Within the Discussion Board area, write 300.docx
jeffsrosalyn
 

More from jeffsrosalyn (20)

Problem 7.  Dollars for WaitingJeffrey Swift has been a messenger.docx
Problem 7.  Dollars for WaitingJeffrey Swift has been a messenger.docxProblem 7.  Dollars for WaitingJeffrey Swift has been a messenger.docx
Problem 7.  Dollars for WaitingJeffrey Swift has been a messenger.docx
 
Problem 8-2B(a) Journalize the transactions, including explanation.docx
Problem 8-2B(a) Journalize the transactions, including explanation.docxProblem 8-2B(a) Journalize the transactions, including explanation.docx
Problem 8-2B(a) Journalize the transactions, including explanation.docx
 
Problem 14-4AFinancial information for Ernie Bishop Company is pre.docx
Problem 14-4AFinancial information for Ernie Bishop Company is pre.docxProblem 14-4AFinancial information for Ernie Bishop Company is pre.docx
Problem 14-4AFinancial information for Ernie Bishop Company is pre.docx
 
Problem and solution essay  about the difficulties of speaking Engli.docx
Problem and solution essay  about the difficulties of speaking Engli.docxProblem and solution essay  about the difficulties of speaking Engli.docx
Problem and solution essay  about the difficulties of speaking Engli.docx
 
problem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docx
problem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docxproblem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docx
problem 8-6 (LO 4) Worksheet, direct and indirect holding, interco.docx
 
Problem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docx
Problem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docxProblem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docx
Problem 4-5ADevine Brown opened Devine’s Carpet Cleaners on March .docx
 
Problem 1-4A (Part Level Submission)Matt Stiner started a delivery.docx
Problem 1-4A (Part Level Submission)Matt Stiner started a delivery.docxProblem 1-4A (Part Level Submission)Matt Stiner started a delivery.docx
Problem 1-4A (Part Level Submission)Matt Stiner started a delivery.docx
 
PROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docx
PROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docxPROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docx
PROBLEM 5-5BPrepare a correct detailed multiple-step income stat.docx
 
Problem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docx
Problem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docxProblem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docx
Problem 12-9ACondensed financial data of Odgers Inc. follow.ODGE.docx
 
Problem 13-6AIrwin Corporation has been authorized to issue 20,80.docx
Problem 13-6AIrwin Corporation has been authorized to issue 20,80.docxProblem 13-6AIrwin Corporation has been authorized to issue 20,80.docx
Problem 13-6AIrwin Corporation has been authorized to issue 20,80.docx
 
Problem 1-2A (Part Level Submission)On August 31, the balance sh.docx
Problem 1-2A (Part Level Submission)On August 31, the balance sh.docxProblem 1-2A (Part Level Submission)On August 31, the balance sh.docx
Problem 1-2A (Part Level Submission)On August 31, the balance sh.docx
 
Problem 1-2A (Part Level Submission)On August 31, the balance shee.docx
Problem 1-2A (Part Level Submission)On August 31, the balance shee.docxProblem 1-2A (Part Level Submission)On August 31, the balance shee.docx
Problem 1-2A (Part Level Submission)On August 31, the balance shee.docx
 
Prior to posting in this discussion, completeThe Parking Garage.docx
Prior to posting in this discussion, completeThe Parking Garage.docxPrior to posting in this discussion, completeThe Parking Garage.docx
Prior to posting in this discussion, completeThe Parking Garage.docx
 
Prior to engaging in this discussion, read Chapters 10 and 11 in y.docx
Prior to engaging in this discussion, read Chapters 10 and 11 in y.docxPrior to engaging in this discussion, read Chapters 10 and 11 in y.docx
Prior to engaging in this discussion, read Chapters 10 and 11 in y.docx
 
Privacy in a Technological AgePrivacy protection is a hot top.docx
Privacy in a Technological AgePrivacy protection is a hot top.docxPrivacy in a Technological AgePrivacy protection is a hot top.docx
Privacy in a Technological AgePrivacy protection is a hot top.docx
 
Privacy Introduction Does the technology today Pene.docx
Privacy Introduction Does the technology today Pene.docxPrivacy Introduction Does the technology today Pene.docx
Privacy Introduction Does the technology today Pene.docx
 
Prisoner rights in America are based largely on the provisions of th.docx
Prisoner rights in America are based largely on the provisions of th.docxPrisoner rights in America are based largely on the provisions of th.docx
Prisoner rights in America are based largely on the provisions of th.docx
 
Principles of Supply and Demanda brief example of supply and deman.docx
Principles of Supply and Demanda brief example of supply and deman.docxPrinciples of Supply and Demanda brief example of supply and deman.docx
Principles of Supply and Demanda brief example of supply and deman.docx
 
Primary Task Response Within the Discussion Board area, write 300.docx
Primary Task Response Within the Discussion Board area, write 300.docxPrimary Task Response Within the Discussion Board area, write 300.docx
Primary Task Response Within the Discussion Board area, write 300.docx
 
Pretend you are a British government official during the time leadin.docx
Pretend you are a British government official during the time leadin.docxPretend you are a British government official during the time leadin.docx
Pretend you are a British government official during the time leadin.docx
 

Recently uploaded

1029-Danh muc Sach Giao Khoa khoi 6.pdf
1029-Danh muc Sach Giao Khoa khoi  6.pdf1029-Danh muc Sach Giao Khoa khoi  6.pdf
1029-Danh muc Sach Giao Khoa khoi 6.pdf
QucHHunhnh
 
Seal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptxSeal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptx
negromaestrong
 
Making and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdfMaking and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdf
Chris Hunter
 
The basics of sentences session 3pptx.pptx
The basics of sentences session 3pptx.pptxThe basics of sentences session 3pptx.pptx
The basics of sentences session 3pptx.pptx
heathfieldcps1
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
PECB
 

Recently uploaded (20)

Class 11th Physics NEET formula sheet pdf
Class 11th Physics NEET formula sheet pdfClass 11th Physics NEET formula sheet pdf
Class 11th Physics NEET formula sheet pdf
 
ICT role in 21st century education and it's challenges.
ICT role in 21st century education and it's challenges.ICT role in 21st century education and it's challenges.
ICT role in 21st century education and it's challenges.
 
Nutritional Needs Presentation - HLTH 104
Nutritional Needs Presentation - HLTH 104Nutritional Needs Presentation - HLTH 104
Nutritional Needs Presentation - HLTH 104
 
Food Chain and Food Web (Ecosystem) EVS, B. Pharmacy 1st Year, Sem-II
Food Chain and Food Web (Ecosystem) EVS, B. Pharmacy 1st Year, Sem-IIFood Chain and Food Web (Ecosystem) EVS, B. Pharmacy 1st Year, Sem-II
Food Chain and Food Web (Ecosystem) EVS, B. Pharmacy 1st Year, Sem-II
 
1029-Danh muc Sach Giao Khoa khoi 6.pdf
1029-Danh muc Sach Giao Khoa khoi  6.pdf1029-Danh muc Sach Giao Khoa khoi  6.pdf
1029-Danh muc Sach Giao Khoa khoi 6.pdf
 
Seal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptxSeal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptx
 
Grant Readiness 101 TechSoup and Remy Consulting
Grant Readiness 101 TechSoup and Remy ConsultingGrant Readiness 101 TechSoup and Remy Consulting
Grant Readiness 101 TechSoup and Remy Consulting
 
TỔNG ÔN TẬP THI VÀO LỚP 10 MÔN TIẾNG ANH NĂM HỌC 2023 - 2024 CÓ ĐÁP ÁN (NGỮ Â...
TỔNG ÔN TẬP THI VÀO LỚP 10 MÔN TIẾNG ANH NĂM HỌC 2023 - 2024 CÓ ĐÁP ÁN (NGỮ Â...TỔNG ÔN TẬP THI VÀO LỚP 10 MÔN TIẾNG ANH NĂM HỌC 2023 - 2024 CÓ ĐÁP ÁN (NGỮ Â...
TỔNG ÔN TẬP THI VÀO LỚP 10 MÔN TIẾNG ANH NĂM HỌC 2023 - 2024 CÓ ĐÁP ÁN (NGỮ Â...
 
This PowerPoint helps students to consider the concept of infinity.
This PowerPoint helps students to consider the concept of infinity.This PowerPoint helps students to consider the concept of infinity.
This PowerPoint helps students to consider the concept of infinity.
 
ICT Role in 21st Century Education & its Challenges.pptx
ICT Role in 21st Century Education & its Challenges.pptxICT Role in 21st Century Education & its Challenges.pptx
ICT Role in 21st Century Education & its Challenges.pptx
 
Unit-V; Pricing (Pharma Marketing Management).pptx
Unit-V; Pricing (Pharma Marketing Management).pptxUnit-V; Pricing (Pharma Marketing Management).pptx
Unit-V; Pricing (Pharma Marketing Management).pptx
 
How to Give a Domain for a Field in Odoo 17
How to Give a Domain for a Field in Odoo 17How to Give a Domain for a Field in Odoo 17
How to Give a Domain for a Field in Odoo 17
 
PROCESS RECORDING FORMAT.docx
PROCESS      RECORDING        FORMAT.docxPROCESS      RECORDING        FORMAT.docx
PROCESS RECORDING FORMAT.docx
 
Making and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdfMaking and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdf
 
2024-NATIONAL-LEARNING-CAMP-AND-OTHER.pptx
2024-NATIONAL-LEARNING-CAMP-AND-OTHER.pptx2024-NATIONAL-LEARNING-CAMP-AND-OTHER.pptx
2024-NATIONAL-LEARNING-CAMP-AND-OTHER.pptx
 
The basics of sentences session 3pptx.pptx
The basics of sentences session 3pptx.pptxThe basics of sentences session 3pptx.pptx
The basics of sentences session 3pptx.pptx
 
Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
 
Mehran University Newsletter Vol-X, Issue-I, 2024
Mehran University Newsletter Vol-X, Issue-I, 2024Mehran University Newsletter Vol-X, Issue-I, 2024
Mehran University Newsletter Vol-X, Issue-I, 2024
 
Measures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDMeasures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SD
 

Chapter 8Finding Lost Files1Old Files Never Die.docx

  • 1. Chapter 8 Finding Lost Files 1 Old Files Never Die Deleting a file doesn’t erase data Even a wiped file may leave behind artifacts Remnants of old files may remain in slack space or unallocated space Temporary files may still exist or be recoverable Some files aren’t deleted, but rather intentionally hidden OS File Recovery Deleting a file sends it to the “Trash” or “Recycle Bin” File is simply renamed and moved to a hidden folder Deleting the file from Recycle marks the space used by the file as available (but does not erase data) Using a WIPE utility overwrites the data on the medium with random characters What is Slack Space? Hard disks are divided into clusters of 4 to 32KB If a file does not fill a cluster, the remainder of the cluster is not overwritten, nor is it available Slack space also exists between partitions on a physical disk Utilities such as Slacker can harness all this space into a usable file system
  • 2. What is Unallocated Space? When a disk is formatted, each cluster is identified and mapped When a file is created or copied to the system, the file system marks the clusters it occupies as “allocated” When a file is removed from Recycle, the clusters aren’t erased, but merely marked as “unallocated” Unallocated space can hold a lot of data Recovering Deleted Files Specialized utilities read the file system metadata and identify clusters where files once lived If the space has not been overwritten, the files can be recovered intact Mark space as allocated Give the file a new name Disk editing utilities allow the residual data from partially overwritten files to be copied to a new file Data Carving Files in unallocated space can be retrieved by “data carving” All bits stored on the medium beginning with a file header and going through to an end of file marker are copied to a new file Few utilities can salvage files stored on noncontiguous clusters Data Carving Tools Carver Foremost Scalpel