- Windows Forensics Cookbook
- Oleg Skulkin Scar de Courcier
- 225字
- 2021-07-02 20:57:48
How to do it...
Before you start, it's a good idea to find the right data source. ReFS is an active development, and is used usually on Windows servers only. Thankfully, Willi Ballenthin has created a bunch of ReFS images for testing purposes, which are now publically available. Let's use one of them.
- Start ReclaiMe File Recovery. It takes some time for the tool to scan all available drives. After this, you will be taken to the main window, like the one in the following figure:

Figure 4.13. ReclaiMe File Recovery main window
ReclaiMe File Recovery doesn't support E01 images, but this is not a problem because we have an image in RAW format.
Let's go to Disks - Open disk image... Choose the disk image and click Open. Now there should also be an image in the main window, like the one in the following figure:

Figure 4.14. ReclaiMe File Recovery main window (Disk image is added)
- Double-click the image to start the recovery process. Of course, it will take some time, depending on the size of the image. In our case, the image is small enough, so it doesn't take a lot of time. The recovery is shown in the following figure:

Figure 4.15. ReclaiMe File Recovery image processing results
- Now you can save recovered files or even folders using the blue Save button.
推薦閱讀
- 零基礎(chǔ)學(xué)C++程序設(shè)計
- Java入門很輕松(微課超值版)
- Java從入門到精通(第4版)
- Rust Cookbook
- Mastering Apache Maven 3
- 第一行代碼 C語言(視頻講解版)
- Python圖形化編程(微課版)
- Android開發(fā)三劍客:UML、模式與測試
- Building Serverless Architectures
- 多媒體技術(shù)及應(yīng)用
- Instant Apache Camel Messaging System
- SFML Game Development
- 計算機程序的構(gòu)造和解釋(JavaScript版)
- Django 3 Web Development Cookbook
- Mastering PostgreSQL 11(Second Edition)