EnCE · Domain 4
Data Recovery
About 12% of the exam
Recovery hierarchy
- Live files
- Deleted with metadata
- Journal and snapshot copies
- Carved from unallocated
- Fragments in slack
- Metadata recovery preserves names and times
- Carving recovers content without context
- Fragments still support keyword findings
- Record which tier each item came from
Say how a file was recovered, because a carved file and a metadata recovery carry very different weight
What deletion really does
- The entry is marked available for reuse
- Content stays until clusters are reallocated
- Heavy use overwrites free space fastest
- Trim clears flash cells much sooner
- Wiping tools may leave metadata behind
- Names and times can survive lost content
File carving
- Header match
- known signature marks a candidate
- Footer match
- expected end marker bounds it
- Maximum size
- cap when no footer appears
- Structure validation
- internal fields must be consistent
- Fragment reassembly
- pieces stitched in the right order
- False positive
- signature present, content meaningless
Carving pitfalls
- Correct size does not prove correct order
- Fragmented files carve into nonsense
- Reused clusters mix two files together
- Structural validity is not relevance
- Duplicate carves inflate apparent counts
- Cross reference before relying on one carve
A carved file that opens cleanly can still hold blocks belonging to a completely different file
Where deleted content survives
On the volume
- Unallocated clusters awaiting reuse
- File slack after the logical end
- Index slack in directory structures
- Records marked free but intact
In system copies
- Snapshots taken before the deletion
- Restore points and backup images
- Journals naming the removed files
- Temporary and auto recovery files
In derived data
- Thumbnail caches keep small previews
- Search indexes retain metadata
- Print spool remnants keep documents
- Application caches keep working copies
Recycle and trash artifacts
- Paired records hold metadata and content
- Metadata gives original path and deletion time
- Older systems used a single index database
- Cross check the path against the directory tree
- Emptying leaves the content in unallocated space
- Per user folders separate the accounts
Databases and structured stores
- Deleted rows may persist inside pages
- Write ahead logs hold recent transactions
- Journals may predate a later update
- A recovered row may be an old version
- Free list pages retain removed records
- Note which structure supplied each row
Archives and containers
- Entries often decompress independently
- Damage to one entry can spare others
- Encryption blocks structural repair
- Nested archives hide the real payload
- Proprietary variants need matching tools
- Extract to a controlled working folder
Virtual disks and sync clients
- Dynamic disk
- host size smaller than guest capacity
- Delta chain
- every parent file must be present
- Snapshot state
- consolidation decides what you see
- Sync database
- local paths and last change times
- Selective sync
- only part of the account is local
- Server side logs
- independent check on local claims
Damaged media and arrays
Failing disks
- Image once, carefully, before anything else
- Log unreadable sectors and retries
- Avoid repeated stress on dying media
- Consider specialist recovery for physical damage
Arrays
- Image members individually where possible
- Wrong stripe size corrupts at intervals
- Parity tolerates only one lost member
- Verify reconstruction before analyzing content
Wiped media
- Describe the pattern you actually observed
- Patterns can suggest the tool used
- Distinguish routine overwrite from deliberate erase
- Overwritten content is generally unrecoverable
Naming the wiping pattern tells a reviewer far more than a bare statement that the drive looks wiped
Validating recovered items
- Open the file with a matching application
- Check internal metadata for consistency
- Compare against other case evidence
- Hash every recovered item
- Record the recovery method and tool version
- Flag items that only partially reconstructed
Reporting recovery work
- State the tier each item came from
- Distinguish complete from partial recovery
- Explain what could not be recovered and why
- Note deduplication that reduced the counts
- Give the configuration a reviewer would need
- Avoid implying intent from deletion alone
Key artifacts
- Deleted record
- metadata surviving the removed name
- Thumbnail cache
- preview outliving the original image
- Auto recovery file
- interim version saved automatically
- Print spool remnant
- document data queued for printing
- Write ahead log
- recent rows not yet merged
- Restore point
- earlier system state preserved
Know the order
- Recover from metadata
- Check snapshots and backups
- Mine journals
- Carve unallocated space
- Sweep slack
- Validate everything
Work from the richest context downward, so names and timestamps survive wherever they still exist
Reference strip: recovery sources
Volume level
- Unallocated cluster space
- File and index slack
- Intact but freed records
- Sectors flagged bad
System copies
- Snapshots and restore points
- Backup images and archives
- Journals and transaction logs
- Temporary and auto recovery files
Derived caches
- Thumbnail and preview caches
- Search index databases
- Print spool remnants
- Application working copies
Carving discipline
- Header, footer and size limits
- Structure validation before acceptance
- Fragment order verification
- Deduplicate before counting
Reporting
- Method and tool version
- Complete versus partial recovery
- Corroboration from other evidence
- Limits stated plainly
Quick exam traps
- Trap: A carved file of the right size is definitely intact
- Trap: Emptying the recycle folder destroys the file content
- Trap: A recovered database row shows the values at deletion
- Trap: Structural validation proves a carved file is relevant
- Trap: Overwritten content can be recovered with the right tool
- Trap: A wiped drive tells you nothing about the tool used
- Trap: Every logical copy on a deduplicated volume is a physical copy
cybercertprep.com · original revision sheet written from the public body of knowledge