Graphics files were deleted from a digital flash memory card. How can I identify and restore the deleted files using computer forensics software?
Previously deleted graphics files can be restored from flash memory cards by using Graphics File Extractor in combination with NTI’s GetFree software. This is accomplished by mounting the flash memory card using a USB or parallel port flash memory card reader, e.g., the Memorex USB CompactFlash Card Reader. Once the drive is mounted the unallocated file space can be captured in DOS or in a Windows DOS box using GetFree. When this is done the output file should be directed to a separate computer storage device rather than the subject flash memory card. The output file can then be quickly processed using Graphics File Extractor to recover all of the deleted GIF and JPG files.