Tell me if I’m wrong, but should data carving be done on the non-mounted block device? If mounted, would the deleted file bytes be invisible since the mounted directory is just a "metaphor" of the OS, obscuring the hidden data?
2025-1-21 13:31:36 Author: www.reddit.com(查看原文) 阅读量:9 收藏


文章来源: https://www.reddit.com/r/computerforensics/comments/1i6imoz/tell_me_if_im_wrong_but_should_data_carving_be/
如有侵权请联系:admin#unsafe.sh