Forensics: Deleting and Wiping Data
A lot of the debates about data deletion and hard drive destruction is due to a combination of urban myth, misinformation, old technology, misunderstanding, exaggeration, blaggers and trolls. This...
View ArticleForensics: NTFS Deleted Entry
When a file is deleted in NTFS, it is marked as deleted within the MFT entry for that file. This is is shown at offset 22 for 2 bytes, bytes 22 and 23.
View Article
More Pages to Explore .....