> EnCase will not perform recovery of overwritten data - that is -
> *physically* overwritten by the read/write head. That is the arena of
> Magnetic Force Microscopy (MFM).
*** I normally will not open my mouth (I'd rather learn
then make a fool of myself) but I have to ask. If your
hard drive is partitioned off & you cut & paste everything
from lets say E drive to F drive will Encase pull up
the files/folders of what was under what you just moved
that was written on top of or, will it only pull up
what you just moved ????? I can read what is above
but don't know if that means if you don't move the folders
or once overwritten the folders under it are gone. I have
Encase but haven't yet messed with it. I have with
Evidence Eliminator & quickly learned to read directions
first (or ask someone knowledgeable) !!
Thank you, Shelly
""ABLE Process Service & Investigative Research"" (co-owner)
Registered,Lic.'ed,bonded & insured.
P.O.Box 841 Lake Isabella, Ca. 93240. 760-378-2329/fax-760-378-0055
Member of :ALSS (a new So.CA. assoc.) NAIS, Chamber of Commerce,
FOE, assisting the L.A. county coroners office & more.
Process service, Investigative researching using public records & resources.
Doing asset searches, missing person locates, background checks & more.
rashel1at_private " Everything I say is my opinion "only".
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Oct 03 2001 - 04:15:41 PDT