Often when you can't find what you're looking for, it's because the data is in the swap file (Virtual Memory). With DirSnoop you can sequentially search all the clusters on the drive. I was not able to go back to the cluster and see the modified data after restarting. I modified an existing text file with the drive frozen, and had different results. And guess what? There were more bytes free with Deep Freeze FROZEN!!
could Deep Freeze be using a hidden compressed drive? Also, under File/Drive Parameters I saved the parameters with Deep Freeze frozen and thawed. They all seem to have a high cluster number. Note the 1st Cluster with DirSnoop of the files you create. Just to the left, under Cluster Data, you will see the text string from the file you created with your c: drive "frozen"!! This, AFTER restarting with your drive "frozen"!! The file reference disappeared, but the data didn't.Ĭreate some other files with your c: drive "frozen" by Deep Freeze. See where it says Jump to:? Enter the cluster number and hit return. Open up DirSnoop and look in the bottom right corner of the program's window. Well, that is only true to a certain degree. This is what Deep Freeze does, right? reverses all changes, added items disappear, deleted items return. After the computer boots up you will see that the file you created is gone. Scroll horizontally to the last two columns and jot down the number of the "1st Cluster" for that file.
Now, open up DirSnoop and navigate to the file you just created. Save the file to your desktop or wherever. This text string is what you are going to view and recover (if you choose) AFTER restarting the computer. With your c: drive "frozen" by Deep Freeze open Notepad and create a simple text file, filling the body with a simple text string, such as "hello hello hello hello".
#Deep freeze software chat trial#
Here's where to download it, and the reg key to delete to continue using it after 25 trial runs.
#Deep freeze software chat install#
There's more to it than that, I'm sure, but here is the experiement I performed:įirst, you need to download and install a forensic hard drive utility that maps out the clusters and numbers them. I just made a very interesting discovery about Deep Freeze: it does not delete data, only file references.
0 kommentar(er)
