One Day Sec

What is PowerForensics and how can it be used to recover deleted files?

PowerForensics is a PowerShell module for forensic analysis, including file recovery. You can import it and run `Get-ForensicFileRecord | Where {$_.Deleted -eq $true} | Select FullName` to list recoverable files, then use the `CopyFile` method on a specific record to restore it. This tool is demonstrated in Penetration Techniques - File Recovery and Deletion in Windows Systems.
PowerForensicsPowerShellfile recoveryGet-ForensicFileRecord

Browse all Q&A →