Digital › Module 4 › Lesson 3
Deleted Recovery Named
Deleted recovery names carving and unallocated recovery — understand concepts on $DFIR_LAB; never plant then 'recover' evidence.
Visual · t26_deleted_recovery_named
Recovery literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Delete often means 'unlink,' not 'erase' — literacy names where bytes may still live.
Deletion marks filesystem entries inactive; data may remain in unallocated space until overwritten. Recovery classes: recycle bin artifacts, MFT inactive entries, file carving by signature (JPEG, PDF headers), and slack space considerations. Tools (Autopsy ingest, photorec-class) automate search — you interpret with CoC and hashes. Cyberlium names recovery concepts on YOUR $DFIR_LAB — course exercises with known planted files are fine when labeled lab — never plant evidence on unauthorized systems or misrepresent findings. Next: Disk Lab.
1. Recovery mechanisms (named)
Recycle Bin: $I/$R pair on Windows — user delete path. MFT inactive: file record exists, data runs may persist. Carving: scan unallocated for magic bytes — fragmented files need advanced work.
On $DFIR_LAB, document one recovery class your course image demonstrates — labeled exercise only.
Command guide
Try these commands — Recovery mechanisms (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
xxd hex dump — https://man7.org/linux/man-pages/man1/xxd.1.html (binary inspection literacy) Autopsy hex — https://www.autopsy.com/ (GUI hex viewer context) NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (vim-common / xxd) Built-in (binutils)
macOS: Built-in
Windows: Use WSL or Git Bash xxd Use WSL or install binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
xxd "$LAB_DFIR/evidence/sample.bin" | head -8
strings "$LAB_DFIR/evidence/sample.bin" | grep -i CYBERLIUM || strings "$LAB_DFIR/evidence/sample.bin"Primary tools to practice this lesson: xxd, strings. Reference sites: xxd hex dump (https://man7.org/linux/man-pages/man1/xxd.1.html); Autopsy hex (https://www.autopsy.com/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Limits and overclaim
Overwritten sectors are gone — no Hollywood recovery. SSD TRIM and wear leveling complicate recovery — literacy includes 'may be unrecoverable.'
Reports state confidence and method — not 'we recovered everything' without basis.
3. Ethics: no fake discoveries
Forbidden: planting files, deleting then claiming attacker did it, or recovering from stranger devices without authority. Allowed: recovery class card — mechanism, tool module name, integrity note.
Ship: deleted recovery card — three mechanisms, one lab example, hash note. Next: Disk Lab.
4. What you ship: deleted recovery card for $DFIR_LAB
Three recovery mechanisms, lab example, integrity note. $DFIR_LAB named. NEVER plant evidence. chmod 600.
5. What you record before the next lesson
Date. Recovery card. $DFIR_LAB named. File t26-m04-l03-deleted-recovery-named.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Plant a file then present as breach proof. Promise full recovery from TRIM'd SSD.
Right
Write deleted recovery card for YOUR $DFIR_LAB exercise. Next: Disk Lab.
Mission: name recovery classes on YOUR lab
1) Define carving in one line. 2) Contrast recycle bin vs unallocated. 3) Note overwrite/TRIM limit. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Label course planted files as lab — honesty beats surprise in grading.
Knowledge Check
APPLY: Deleted recovery literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Planting then recovering evidence is forbidden.
True or False
Knowledge Check
APPLY: File carving searches:
Multiple choice