|
Many files are stored sequentially on a disk, but a number of files are actually fragmented. When CnW recovers files it will actually log the location of each fragment. Forensically this can help provide information of when a file has been overwritten, or by which file.
The information is stored in the log. The frags column will show the number of fragments that the file is stored in. When this number is double clicked, the display below is shown.
The display will indicate the start and length of the first 80 data runs of any file. If a row is double clicked, the sector hex dump will be displayed.
The same information is actually included in any save of the log as a .csv file
Download the demo now to evaluate this feature
|