
Forensic Tool Functionalities
Forensic Functionality: | Deleted File Recovery | ||
---|---|---|---|
Description: | Examining file system metadata to identify deleted files and to attempt their reconstruction or recovery | ||
Technical Parameters: | Tool host OS / runtime environment | Supported file systems | Overwritten file identification |
Windows | FAT12 | supports identifying overwritten files | |
Linux | FAT16 | identifying overwritten files unsupported | |
Mac | FAT32 | ||
NTFS | |||
exFAT | |||
ReFS | |||
EXT2 | |||
EXT3 | |||
EXT4 |