Dear all,
I am new in the forum.
I am conducting an investigation on a Intel NUC, it has a SSD drive. Systsem Windows 10 pro
First I imaged the drive (E01) with ftk imager.
Then I opened it with autopsy 4.15.0 I exported the files on the desktop of the desired user included the file listed as deleted. But lot of them (PDF) we can not open.
So I opened the project with autopsy 4.12, I exported all the file, and again I can’t open them.
Where I am wrong? Are they overwritten files?
thanks in advance
The presence of deleted files is an indication that the files existed at a particular point in time but it is entirely possible that the content has been partially or completely overwritten. Other techniques, such as carving or volume shadow copies, might be useful if the content is important to you.
many thanks for your kind answer.
Best regards
gian