Tech Fixx · Video
File System Forensics: Recover Deleted Files, Metadata & Artifacts
Watch this 3 min 49 sec video from the Tech Fixx channel, published .
Check that the device, software and version shown match your setup. Use the player controls for captions, playback speed and full screen where available.
Loading the player connects to YouTube. If playback is unavailable here, watch on YouTube ↗.
Captions and text transcripts
After loading the player, use its CC control to turn on captions when available. To look for a text transcript, use the Watch on YouTube link above, expand the video description and select “Show transcript” if offered.
Caption and transcript availability varies by video, and automatic captions may contain mistakes. The original channel description is separate from a transcript. Caption accuracy, audio description and text alternatives have not been verified for every video in this library.
From the video description
Original channel description, recorded . Product, software and service references in it may have changed since publication.
File-system forensics examines how an operating system organises files, directories, timestamps and storage structures. This introduction explains what may remain after a file is deleted and how investigators interpret metadata and artifacts without promising that every file can be recovered.
You’ll learn: • Allocated versus unallocated space • File records, directory entries and timestamps • Deleted-file metadata and data carving • Fragmentation and recovery limitations • SSD wear levelling and TRIM • Creating a forensic image and working from a copy • Using tools such as Autopsy to examine artifacts
Recovery depends on the file system, device, encryption, later writes and other factors. Use only on media you are authorised to examine.
NIST forensic guidance: https://csrc.nist.gov/pubs/sp/800/86/final
#FileSystemForensics #DeletedFiles #AutopsyForensics