While working with Eraser 6.0.10, found a pattern 0x21 00 21 00 00 00 00 00 21 00 00 00 00 00 00 00 in the directory entry of the deleted file. This is for a FAT file system on a pendrive <=128 MB.
For a forensic investigator, this pattern will clearly indicate Eraser tool being used.
Is...
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.