Can I detect if a file is deleted?
I would have expected there to be some kind of property that told me whether the file was deleted. For example,
def process(self, file):
if (file.properties == TskData.TSK_FILEPROPERTY.FILE_DELETED): self.Log(Level.INFO, "Success!")
Does anyone know the correct way to do this?
I’ve been sniffing around the TSK_DB_FILES_TYPE_ENUM.UNALLOC_FILES but this isn’t giving me the results that I expect.
Thanks for any help!