🔍Recovering Deleted and Damaged Files

Description

This project demonstrates the recovery of deleted files using Windows and Linux systems. E3 was employed to restore files from NTFS drive images, DiskDigger was used for recovering deleted files in Windows, Autopsy provided additional forensic analysis, and PhotoRec was utilized for file recovery across various file systems. The project highlights proficiency in diverse data recovery tools and techniques, showcasing the ability to retrieve critical information from multiple storage environments.

Tools Description:

E3: A forensic tool used for recovering deleted files from NTFS drive images, providing in-depth analysis and restoration capabilities.

DiskDigger: A data recovery tool for Windows that can recover deleted files from various file systems, including FAT and NTFS.

Autopsy: A digital forensics platform used for analyzing disk images and recovering deleted files, offering a comprehensive suite of tools for data extraction and analysis.

PhotoRec: A file recovery tool that specializes in recovering lost files from a variety of file systems, including FAT, NTFS, and ext, by scanning the storage media for file signatures.

Languages and Utilities Used

• Powershell
• E3
• Autopsy
• PhotoRec
• DiskDigger

Environments Used

• Windows 10 (21H2)
• Linux (21H2)

Program Reflection & Code:

E3 Deleted Files:


File Viewer & Recovered Files:


Autopsy Deleted Files & Recovery:


DiskDigger Deleted FIles and Recovery:


PhotoRec Deleted Files and Recovery (View of Directory):


PhotoRec Failed Mount Attempt:


PhotoRec compressed file recovered (contd.):


Backup files recoverd from RAR Archive: