R-Studio writes directly to a hard drive only when writing recovered data and from its hex editor, if writing is enabled. In all other actions, R-Studio only reads data and analyzes them, and never modifies data on the hard drives being analyzed.
Most operating systems use lazy-write. So, there is a time lag between file actions and actual changes on data on a hard drive. R-Studio analyzes data on hard drives only. That is why it does not always detects recent changes in data structure.
Most operating systems constantly write their service information on hard drives. Such writing is especially intensive during start-up and shut-down procedures. When an operating system deletes a file/folder, it treats the space where it has resided as empty and may write something in this place. If this happened, the file/folder and its parameters may be detected correctly, but its data may be lost.
0 comments:
Post a Comment