Hello,
I am unable to properly recover deleted files in their entirely. These files were added to the recycle bin and then deleted in a Windows 10 VM. The VM was then immediately imaged using FTK Imager. I can find the deleted files in the deleted files folder in Autopsy but when I extract them they are not the same files. I even tried to rename them to the original files without any luck. The file size is also different. I am trying to recover a test set of encryption keys that is part of a training exercise. I wouldn’t think the files would have already been overwritten by anything. They should be intact. Is there another step needed to carve out the files?
Any suggestions would be greatly appreciated!