Block or Cluster will be either used or unused in a file system. When I say it’s unused, so it doesn’t mean that the block or cluster is ‘Blank’. It might be possible that it has some deleted data.
For example- If a word file was stored is multiple blocks, and you deleted it. Some blocks are used by the file system to store another file. Question: Is it possible to recover the whole work file? No, but you can recover some fragments (Unused blocks) of the file (might be half of the file or One page)
0 Comments
Leave a Reply. |
Mac Forensics
|