Joined: Jan 13, 2009 Posts: 14 Location: Los Angeles, CA
Posted: Fri Feb 27, 2009 10:03 am Post subject:
Many flash drives use FAT32 so recover is usually straight forward. As for whether it was copied - did you mean "before" it was deleted? If so, it is possible, but not really from the file; you'd have to look for traces of it somewhere else. The access time may be helpful, but that doesn't mean that it was copied.
I just recovered several files from a 1GB SanDisk Cruzer Mini that the actor (not a 'suspect' yet) had deleted. Most of the commercial flash devices are probably using FAT32, so it is easily done if the file hasn't been overwritten.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum