Data Recovery

There are two main forms of data recovery in FAT and NTFS file systems: recovering deleted data from unallocated space and recovering data from slack space.

WINDOWS BASED RECOVERY TOOLS
EnCase, FTK, and X-Ways

UNIX BASED RECOVERY TOOLS
Sleuth Kit and SMART

FILE CARVING WITH WINDOWS

Forensic tools such as EnCase, FTK, and X-Ways have file carving functionality and can be configured with user-defined file headers and footers.
In addition, specialized file carving tools such as DataLifter (Figure 17.9) can recover many types
of files including graphics, word processing, and executable files.
Some of these tools can extract images from other files such as images stored in Word documents.

DEALING WITH PASSWORD PROTECTION AND ENCRYPTION