There are several methods and tools that can be used to recover and analyze data that has been deleted. Data Stream Carving allows the forensic examiner to extract data fragments from memory and unallocated space. The types of data fragments include, chat sessions, webmail email messages, Facebook pages, chats and email messages, and Internet history, File Carving will allow the examiner to extract files from memory and unallocated space, including Microsoft Office documents, photos and video files.



Next – Browser Forensics