Forensic Tool Functionalities
| Forensic Functionality: | Deleted File Recovery | ||
|---|---|---|---|
| Description: | Examining file system metadata to identify deleted files and to attempt their reconstruction or recovery | ||
| Technical Parameters: | Tool host OS / runtime environment | Supported file systems | Overwritten file identification |
| N/A | N/A | N/A | |
| Windows | CDFS | supports identifying overwritten files | |
| Windows 11 | FAT | identifying overwritten files unsupported | |
| Windows 10 | FAT12 | ||
| Windows 8.1 | FAT16 | ||
| Windows 8 | FAT32 | ||
| Windows 7 | NTFS | ||
| Linux | exFAT | ||
| Mac | ReFS | ||
| EXT2 | |||
| EXT3 | |||
| EXT4 | |||
| UDF | |||
| HFS+ | |||