# Data Recovery And Encryption Break

**URL:** <https://sleuthkit.discourse.group/t/data-recovery-and-encryption-break/3498>\
**Category:** Autopsy Help\
**Created:** [November 27, 2022, 10:06pm UTC](https://sleuthkit.discourse.group/t/data-recovery-and-encryption-break/3498 "2022-11-27T22:06:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![withUItsPossible](https://avatars.discourse-cdn.com/v4/letter/w/e47774/32.png) [@withUItsPossible](https://sleuthkit.discourse.group/u/withUItsPossible)\
**Post date:** [November 27, 2022, 10:06pm UTC](https://sleuthkit.discourse.group/t/data-recovery-and-encryption-break/3498/1 "2022-11-27T22:06:04Z")

</div>

Hi I’ve started at forensic analysis and I have some doubts. Could anyone help.

1 - Once the analysis has been performed and deleted files have been recovered, is there any way to recover the content of those files? A forensic analysis has been performed with Autopsy on a piece of evidence and the software recovers deleted files (png, xlsl, pdf) but cannot display their content. Is it possible to see the content of the png, pdf, …, before they were deleted? How?

2- Is it possible to break devices encryption to be able to analyse evidence? Let’s say you don’t have the password that encrypted it. How?

Thanks
