computerguy
Oct 28 2008, 06:34 PM
Hi,
I'm wondering if there is a way to determine the date/time of deletion of a file using Recuva. I've checked in the places I think it would be, but maybe I'm just missing it, or it's simply not there.
Can someone tell me if this is possible?
Regards,
Dusty
Augeas
Oct 28 2008, 09:39 PM
I just picked an innocent file with a date modified of 12/05/08 (I didn't look at its properties at all) and shift/del'd it. In Recuva/Info the date and time last accessed is today/now. So I guess a deletion acts as an access. I haven't tried all the other delete permutations but I should also guess that they count as an access too. PS File recovered fine, ta.
computerguy
Oct 28 2008, 09:52 PM
Thanks... that's what I was hoping... but was the "last accessed" time the time of the recover, or the time of when you deleted it?
Thanks again!
Augeas
Oct 28 2008, 09:55 PM
Deleted, as I looked at it in its deleted state using Recuva.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.