Forensic Tool Functionalities
| Forensic Functionality: | Deleted File Recovery | ||
|---|---|---|---|
| Description: | Examining file system metadata to identify deleted files and to attempt their reconstruction or recovery | ||
| Technical Parameters: | Tool host OS / runtime environment | Supported file systems | Overwritten file identification |
| Windows | FAT12 | supports identifying overwritten files | |
| Linux | FAT16 | identifying overwritten files unsupported | |
| Mac | FAT32 | ||
| NTFS | |||
| exFAT | |||
| ReFS | |||
| EXT2 | |||
| EXT3 | |||
| EXT4 | |||