Orphaned Files in NTFS

[Forensik]

An orphaned file is a file that has been deleted and the parent directory that the file is linked to (within its MFT entry) has also been deleted and then its MFT entry has been reallocated. You can also have an orphaned directory index for the same reason as you can have orphaned files (same basic concepts apply).

More Details: http://dereknewton.com/2010/06/orphaned-files-in-an-ntfs-file-system/

Does OSF find orphan files during a Deleted File Search? It seems not. Is there any way to identify orphan files with OSF?

Best regards

[David (PassMark)]

OSF should be picking up orphaned files.

They appear as files in an "_unknown_" folder. As in the example below.

They might also be picked up as carved files. In which case they won't have their original file name.




If you have a specific example where you think it isn't working we would be happy to have a look at it.