Quote from: bob123 on October 31, 2018, 08:30:31 AM

Quote from: ALANL on October 30, 2018, 08:22:37 PM

i just did 2 things copy all data to my laptop using External usb hardrive mount ( Copy + Paste ) and tried to recovery search using EaseUS data recovery and recuva, but didn't recover or write anything on the hard drive

Well, this couldn't have worked.
Simple copy/pasting only copies files 'registered' by the file system.

When files are being deleted, they are not really 'taken off the drive'. The space where they ware saved is being released instead.

Therefore you either need to (1) work on the original drive (NOT recommended!) or (2) on an image of the drive (recommended).

Quote from: ALANL on October 30, 2018, 08:22:37 PM

now i will follow ur steps and Clone my hard-drive and check Jack pywallet.

Keep us updated. For cloning you might want to boot a linux live distro and use dd.

I used FTK imager 4.2.0 to clone the hard drive just managed to finish one, i made 2 copies .E01 and dd don't know the difference but better to take precautions

now i downloaded Autopsy 4.9.0 for windows with GUI and started examining the 'evidence' .E01 still under process analyzing files