开发者

How to show list of deleted files in windows file system

开发者 https://www.devze.com 2023-01-06 10:08 出处:网络
I am wondering if it is possible to compile a list of deleted files on a windows file system, FAT or NTFS.I do not need to actually recover the files, only have access to their name and any other acce

I am wondering if it is possible to compile a list of deleted files on a windows file system, FAT or NTFS. I do not need to actually recover the files, only have access to their name and any other accessible time (time deleted, created etc).

E开发者_运维知识库ven if I can run a cmd line tool to achieve this it would be acceptable.

The application is being developed in Python, however if another language has the capability I could always create a small component implemented in that language.

Thanks.


This is a very complex task. I woudl look at open-source forensic tools. You also should analyze the recylcing bin ( not completly deleted file )

For FAT you will not be able to get the first character of a deleted file. For some deleted files the metadata will be gone.

NTFS is much more complex and time consuming due to the more complex nature of this file system.

0

精彩评论

暂无评论...
验证码 换一张
取 消