Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

What happens to a file after it is moved?

Posted on 2009-07-11
5
Medium Priority
?
664 Views
Last Modified: 2012-05-07
I have a customer who MOVED her primary Quickbooks data file (x.QBW) file from her HDD to a Flash Drive. She thought she had just copied it, but instead she moved it. Then she took her flash drive home and attempted to transfer the .QBW over the Internet. She did not know what she was doing and that did not work for her. She then accidentally deleted the .QBW file from her flash drive, thinking that the original was still on her HDD. But Nooooo!

I am using EnCASE in an effort to recover the .QBW file. While I am not yet certified, I have passed the written EnCE certification and I am now waiting for the practical to arrive via UPS. My questions are:

1. What does Windows do when it moves a file? Does it change the file marker to hex e5, just like a deleted file? Or, does it simply remove the allocation marker all together and make the area available for over write? Or, what?

2. What would be the best way to attack this with EnCASE? I have her HDD and her flash drive in my lab so access is not a problem.

3. I THINK the old .QBW file will be found in the Unallocated Clusters on the HDD, but I am not sure. Is it better to attack the HDD first, or the flash drive?

Thank you very much.
0
Comment
Question by:SMPC
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 26

Accepted Solution

by:
akahan earned 2000 total points
ID: 24831613
Moving will have the same effect as deleting.  

You're trying to kill a mouse with a shotgun.  EnCASE is not the appropriate tool for this job.  You could use a simple file recovery program like Recuva to do what you're doing.  There's no harm in using Recuva first (and then graduating to EnCASE if Recuva doesn't do the job), because using Recuva won't change anything on the disk or the flash drive if it's unsuccessful.  I think you're better off going after the flash drive first, just because it's smaller and it'll be quicker.

Obviously, you don't want to install your file recovery software onto the hard drive (or the flash drive); you would install it on some other drive, and then, from there, try to recover the lost data on the hard drive and/or flash drive.

0
 
LVL 1

Author Comment

by:SMPC
ID: 24832040
Of course I know that, but you could not know that I knew that. I was actually practicing for my EnCase practical exam to see what questions came up and this one did. Yes, we have Recuva at the office. It works well and I was going to use it tonight. Thank you.
0
 
LVL 23

Expert Comment

by:Danny Child
ID: 24832175
A move is 2 processes.  A Copy, followed by a Delete.  
0
 
LVL 1

Author Comment

by:SMPC
ID: 24832646
Very good DanCh99! Thnak you for the insight.
0
 
LVL 1

Author Closing Comment

by:SMPC
ID: 31602455
Got tired of messing about with EnCase and used Recuva to get the file in about 5 minutes. Now that I know how it works it does not seem like magic anymore, but, it is one hell of a time saver! Especially since it is Freeware. Still, anyone who uses it like I do should give a donation so I gave another one tonight. Worth it to me and WELL worth it to the customer.
0

Featured Post

Enroll in October's Free Course of the Month

Do you work with and analyze data? Enroll in October's Course of the Month for 7+ hours of SQL training, allowing you to quickly and efficiently store or retrieve data. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
In this era, as you know, cybercrime and other sorts of frauds using the internet has increased day by day. We should protect our information assets and confidential information from getting exploiting by the attacker or intruders. Most of the fraud…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question