Data Recovery- Restore deleted files of USB.
Ooppss! Have you deleted an important file from your USB by mistake?
Don’t worry now we can acquire that deleted file easily by using EnCase Acquisition software.
EnCase Cyber forensics data recovery software allows us to conduct in depth analysis of user files such as documents, pictures, internet history and Windows Registry information. This software is mainly used in forensics investigation to recover evidence form the seized item i.e hard disk, USB etc .
In addition, EnCase compares known file signatures with file extensions so investigators can determine whether the user has tried to hide evidence from detection by changing its extension or not. So it is a very useful software in cyber forensics.
Let’s begin, on how we can acquire the restore deleted files in the USB in just 5 simple steps:-
Step 1. Run the Encase Forensic software in the system and fill the columns.
Step 2. Open EnCase > Go to FastBloc SE und Enable Write Blocked and insert the USB Device to the System from which the data is to recover.
Step 3 . Select Add the Evidence > Add Local Device and Check the box of Only Show Write-blocked und Detect LegacyFastBloc.
Step 4. We can see Details of Deleted Files and the Existing file are shown.
Step 5. The deleted files are marked red and below we can also see the contents of the file. We can export that data by doing right click on the file and select export option.
In forensics investigation investigator create image of the device, so they can use for further investigation to do that we Double Click on Case name and select all file and data inside the device and select Acquire Option. Set the Location Option of the Destination Folder where to save image of the source file.
In just following above steps we can do data recovery from USB device.
In terms of cyber security this software can be useful of recovering deleted files from other system, which can give us crucial information or data.
