Windows Forensics Cookbook
上QQ阅读APP看书,第一时间看更新

How it works...

Autopsy detects files marked as deleted in the MFT and sorts them all out, so a digital forensic examiner can locate such files and recover them.