A criminal realizes they have been busted so they delete all the files on their system to get rid of any evidence. It is up to you to recover the evidence!
Recover the deleted evidence from the criminals system.
Windows Server 2012
Time: 15 Minutes
Starting Screen - Opening The File
When WinHex opens go to File > Open and find your file and open it. click 'OK' on the window that pops up.
When WinHex is done displaying your file go to Tools > Disk Tools then select 'File Recovery By Type'. Click 'OK' if a pop-up appears.
Selecting Type of File
In this lab we will be recovering pictures, so select 'Pictures' and click 'OK'.
A pop-up will appear titled 'Select Target Folder' here is where you select where to save the recovered results. I recommend creating a folder. Start the process by selecting 'OK'.
Once the process is done, a pop-up will appear, click 'OK'. Then go to the destination you selected to save the files and all the recovered files will be there.