| <<< File System Analysis | Index | File Carving >>> |
Orphan files are those that are deleted and no longer have a parent folder.
Also known as "unallocated" files.
In Autopsy they are accessible in the $OrphanFiles folder.
Finding orphan files in FAT file systems is time intensive.
Every cluster must be read and analyzed.
Can be disabled when image is added as data source to the case
| <<< File System Analysis | Index | File Carving >>> |