Excellent explanation of a highly complex process. Is there software that can automate this carving process? If yes, please name the software and also answer the question of when would an examiner need to employ the manual method?
If it’s encrypted you would need the key to decrypt the drive and then would need to determine if it’s been overwritten. It’s not something I’ve spent any time on so I can’t really offer much beyond that.
I took 2 whole lectures for this, but this video clarified manual carving. Thanks
Never understood the significance of data carving until now, as well as tools used in this process! Thanks so much :)
Sehr gut
props to you man. really good
Thank you.
Excellent explanation of a highly complex process. Is there software that can automate this carving process? If yes, please name the software and also answer the question of when would an examiner need to employ the manual method?
Cool video. What about android 13 drives. Permanently deleted files with file based encryption??
If it’s encrypted you would need the key to decrypt the drive and then would need to determine if it’s been overwritten. It’s not something I’ve spent any time on so I can’t really offer much beyond that.