Restore deleted files of USB
Ooppss!!! Have you deleted an important file from your USB by mistake?
Don’t worry now we can acquire that deleted file easily by using EnCase Acquisition software.
EnCase Cyber forensic software allows us to conduct in depth analysis of user files such as documents, pictures, internet history and Windows Registry information. This software is mainly used in forensics investigation to recover evidence form the seized item i.e hard disk, USB etc .
In addition, EnCase compares known file signatures with file extensions so investigators can determine whether the user has tried to hide evidence from detection by changing its extension or not. So it is a very useful software in cyber forensics.
Lets begin, on how we can acquire the lost data in the USB in just 5 simple steps:-
Step 1. Run the Encase Forensic software in the system and fill the columns.
Step 2. Open EnCase > Go to FastBloc SE and Enable Write Blocked and insert the USB Device to the System from which the data is to recover.
Step 3 . Select Add the Evidence > Add Local Device and Check the box of Only Show Write-blocked and Detect LegacyFastBloc.
Step 4. We can see Details of Deleted Files and the Existing file are shown.
Step 5. The deleted files are marked red and below we can also see the contents of the file. We can export that data by doing right click on the file and select export option.
In forensics investigation investigator create image of the device, so they can use for further investigation to do that we Double Click on Case name and select all file and data inside the device and select Acquire Option. Set the Location Option of the Destination Folder where to save image of the source file.
In just few steps we can recover our lost files.
In terms of cyber security this software can be useful of recovering deleted files from other system, which can give us crucial information or data.