Hi there,
I do have a couple of questions related to the functionality of the DFS feature for NTFS:
Why I am asking this questions? Currently I am working on a case where I know that there are deleted images on the partition, but DFS does not show them.
best regards
I do have a couple of questions related to the functionality of the DFS feature for NTFS:
- Do I have to mount the drive image NTFS partition to use DFS?
- Does DFS only recover files marked as deleted in the MFT?
- Does DFS recover (carve) files in unallocated sectors where the MFT entry is already overwritten?
Why I am asking this questions? Currently I am working on a case where I know that there are deleted images on the partition, but DFS does not show them.
best regards
Comment