possibility of recovering records that were effectively "cleared."? about libevtx

[joachimmetz]

Is the record data still in the file?

[ShaneKent]

We're not sure. If it's not still in the file then it makes sense that there is no way to bring it back. But if it still is in the file, would the "get recovered records" functionality recover those?

[joachimmetz]

recovered records in libevtx are those stored outside the allocated chunk data.

There is some minimal checking to see if the event record is recoverable:

libevtx/libevtx/libevtx_chunk.c

Line 899 in 5b41521

if( libcdata_array_append_entry(

If the signature does not match the record will be ignored.

If the data is no longer in the file, then there is nothing to recover.

[ShaneKent]

Thanks for helping me to understand this. You've definitely cleared this all up.

[joachimmetz]

Good to know, closing this issue then