Search results
-
M
removing last access, last change data
While working with Eraser 6.0.10, found a pattern 0x21 00 21 00 00 00 00 00 21 00 00 00 00 00 00 00 in the directory entry of the deleted file. This is for a FAT file system on a pendrive <=128 MB. For a forensic investigator, this pattern will clearly indicate Eraser tool being used. Is...- mastermind
- Post #6
- Forum: Data Forensics