aylesworth

Okay thanks!

Cool thanks for the info. Basically, we've got a user that claims that nothing was deleted, but files 'vanished'. I'm trying to figure out if they were deleted by the user or by the system, and I'm having a hard time figuring out if system deleted files appear with an MFT entry just as normally deleted files do. Basically, will Recuva see files deleted by the system as they would by a user?

Hello, I've used Recuva a few times and love it, however the question has been brought to my attention: What types of deletions count as actual deletions? If a system process removes a file, will Recuva be able to see that and mark it as restorable or not? In a nutshell, I'm trying to use Recuva to figure out if a user deleted a file, or if the deletion was system generated. Would Recuva see files deleted in both ways with the same result? Would there be any indication that a file was deleted by system rather than a user? Thanks!