A File's Life - File Deletion and Recovery

Good morning!


It's time for a new 13Cubed episode covering file deletion and recovery. We'll look at exactly what happens when you delete a file from an NTFS file system. Then, we'll talk about file "undeletion" versus file carving, and use PhotoRec to perform file carving against a mounted disk image. Lastly, we'll explore techniques to search through that recovered data using an Ubuntu WSL 2 instance.


Episode:
[https://www.youtube.com/watch?v=4zlk9ZSMa-4](https://www.youtube.com/watch?v=4zlk9ZSMa-4)

For a complete 13Cubed Episode Guide, check out [13cubed.com/episodes](http://13cubed.com/episodes).


And, check …

computerforensics delete deletion disk file file system life ntfs recovery system