What does the "recover folders " option in encase actually represent, i.e. what is it recovering? And where from? Is it unallocated clusters? Or if not where?
And is "carving" the art of recovering data from unallocated clusters? Or can you "carve" data from other places aside unallocated? Does encase come with any tools to automatically carve any recoverable files from that are of disk? Or does that take manual manipulation? Finally is there any feature in encase to mount an image file as a seemingly local drive so you can view files as though it was the examination machine local disk - or to "mount" does that require a 3rd party tool?