Scribd
Upload
28 views

SO Playbook - Digital Forensics

The document discusses how to recover deleted files from external hard drives or storage devices using software tools, command prompt commands, or by restoring previous versions of files. It provides steps to recover deleted files without overwriting data on the drive and risking permanent file loss.

Uploaded by

olexxxandrus
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
28 views

SO Playbook - Digital Forensics

The document discusses how to recover deleted files from external hard drives or storage devices using software tools, command prompt commands, or by restoring previous versions of files. It provides steps to recover deleted files without overwriting data on the drive and risking permanent file loss.

Uploaded by

olexxxandrus
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

MISSION: Making security more handy.

DIGITAL
PREVENT HACKERS AND HIJACKERS
FORENSICS PREVENT VIRUSES
RECOVER DELETED INFORMATION
PLAYBOOK IDENTIFYING AREAS OF WEAKNESS AND VULNERABILITIES

Recover Deleted Files

Tips before recovery:

Stop using your hard drive from which you want to recover the deleted files. Once the deleted data is overwritten by new content, there will be no way to get it back.
Don’t format the external hard drive.
Don’t try to repair your hard drive.

Using software

1. Download the recovery software.


2. Select the disk or card containing your deleted files and allow the tool to scan for missing files.
3. Select the files to recover.
4. Choose a save location, which must be different to the original location.

FILE SYSTEM Using CMD


FORENSICS 1. Connect your external hard drive to your computer.
2. Press Win + R keys to launch the Run program.
3. Type cmd and click OK.
4. Type the following command in the CMD window and hit enter: ATTRIB -H -R -S /S /D X:*.*
5. Make sure to replace “X” with the actual drive letter of your external hard drive.

By restoring previous version of a file

1. Navigate to the folder where your files were stored before deletion.
2. Right-click inside the folder and select Properties.
3. Open the Previous Versions tab.
4. Select which previous version you want to recover.
5. Click the Restore button.

You might also like