Lab - Recovering Data Using Recuva

Lab Scenario

You have recently taken a suspect into custody, upon searching them you discover they only have a flash drive in their possesion. But when you go to look at the contents it is empty, use Recuva to find the deleted contents of the drive.

Lab Objectives

Recovering Deleted Files using Recuva.

Lab Environment

Windows 10

Lab Duration

Time: 15 Minutes

Lab Information

Starting Screen

When the tool is first opened this welcome wizard will appear, select next.

Select File Type

Here you can select type of files you want to recover.



Select File Location

Here, you will want to select 'In a Specific Location' and then 'Browse...' and select the drive you would like to recover files from.

Deep Scan

On this screen, you can select 'Enable Deep Scan' which makes the scan return a lot more files. In this demonstration, Deep Scan was turned on.

Scan Results

This is the result from the Deep Scan on the drive used, it shows the file path, last time it was modified (if available), file size, and the state of the file. To recover the file, check the checkbox and select 'Recover' in the bottom right of the screen, then select the location to put it.