Deleted Content Recovery
In this hands-on lab, you will learn the basics of recovering deleted data within the context of a forensic investigation. You will practice using various tools and data carving techniques to recover deleted data.

Course Content
Upon completing this lab, you should be able to:
- Define key terms associated with deleted content recovery.
- Describe what happens when a file is deleted from an NTFS volume.
- Recover a deleted file that resides in contiguous sectors using automated tools.
- Recover individual Windows Event Log records using individual tools.