X-Ways WinHex v20.0 Specialist License
Refine Volume Snapshot
1) Particularly thorough file system search
• FAT12/FAT16/FAT32: This option searches for orphaned subdirectories (subdirectories that are no longer referenced by any other directory).
• NTFS: This option searches for FILE records in sectors that do not belong to the current MFT. Such FILE records can be found e.g. after a partition has been recreated, reformatted, moved, resized, or defragmented. With a forensic license, in a second and third step, this option also searches INDX buffers and $LogFile for noteworthy index record remnants, which either reveal previous names or paths of renamed/moved files/directories that were known to the volume snapshot before or deleted files that the volume snapshot was not aware of before (without file contents, though).