Recovering and Deleting Files Total Recall Lab

[toggle_content title="Transcript"] Hey, Leo Dregier here. I want to continue the file discovery discussion with a program, uh, called Total Recall Data Discovery software. So we'll go ahead and open that up, okay. Eh, I'm not going to upgrade to the new version now, just – this is for evaluation purposes anyway. One of the things you can do is go right up here to File and Disk. It'll scan your current drives, and so we're going to work on the smallest increment. You'll appreciate this because the larger file certainly will take some time to scan. Literally, set it, let it run overnight, come back tomorrow, and it still might be running, that type of evaluation. So even at, you know, 500 megabytes you can get an idea of how long this will take. So we're going to go with this little USB flash drive that's, um, plugged into the computer here. We're going to evaluate the drive, scanning drive. Please wait while Total Recall scans your device for files. Well, I can kind of save you a little time here. Um, the current status is scanning disk, so just 500 megs is basically about 10 minutes worth of scanning, but it's already found the six files that I already know are deleted on this USB drive. Um, they found the system structures three and identified files six. So we're going to go ahead and let this run, basically, until, um, until the, the evaluation continues. Okay, now that the scan is complete of the drive, the USB drive as you can see right up here. You can see a pull – a whole bunch of partition information and the size of that. Um, it pulled some FAT16 information, some FAT32 information. Um, down here it looks like it got the, uh, master file table only, uh, for the different partition blocks. So you can go ahead and check a few of these, uh, if you like. Apparently in the evaluation you can only set six, um, so it will go ahead and build a files list. Total Recall is building a virtual file system in memory. This doesn't take nearly as long as the evaluation. Now that the, uh, scan is complete, you actually can go through and dig down into the specific directories and file structures of the lost file system. Um, so you can see some of the things that I've had on this drive before that they've covered, some brochures, some Linux information, uh, when I was doing some Ubuntu training, some slides. Uh, so it pulled quite a bit of information, classroom material, for example CISSP. Uh, these are all things that have been on the, on the drive in the past, image files, Power Point files, Word documents. Uh, so quite impressive in terms of being able to pull the information back off the drive. Then, of course, you can go ahead and save the files. So that's how you recover deleted file information forensically from a file system. [/toggle_content] Welcome to the Total Recall lab.  In this lab we continue with file recovery tools demonstration by scanning a USB drive.  Total Recall is a very thorough, time consuming scanning tool. You’ll learn from observing it the myriad information it provides on the partition of the scanned device, down the most minute details including every file system and type, master boot record, partition table data. You also see how Total Recall builds a master files list which is a virtual file system in memory and how you can recapture the files its recovered.
Recommended Study Material
Learn on the go.
The app designed for the modern cyber security professional.
Get it on Google Play Get it on the App Store

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play

Support Cybrary

Donate Here to Get This Month's Donor Badge

Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?