What is PowerForensics and how can it be used to recover deleted files?
PowerForensics is a PowerShell module for forensic analysis, including file recovery. You can import it and run `Get-ForensicFileRecord | Where {$_.Deleted -eq $true} | Select FullName` to list recoverable files, then use the `CopyFile` method on a specific record to restore it. This tool is demonstrated in Penetration Techniques - File Recovery and Deletion in Windows Systems.
PowerForensicsPowerShellfile recoveryGet-ForensicFileRecord