I'm able to obtain file names and their contents from vdi image using
grep despite the files were deleted. Example output:
MICROS~3.DLLans0��1FR�b��?,|�R��?,|�R��?,|�R�� !Microsoft.Transactions.Bridge.dll�H^@�x�x�1_��9�����yFILE0��m8��`HFR�b��FR�b��o�}�R��o�}�R�� �0xZ1FR�b��o�}�R��o�}�R��o�}�R��
When I mount the vdi image using
grep can't find the same information. I've also tried wiping free space with
sdelete, but without effect. How could I remove this information?
Update: Example output with email:
file.ext.LCK0xZ��0̮=T��0̮=T��0̮=T��0̮=T�� FILEEX~1.LCK�X<NAMENAMENAME__aaaaaaaaa@aaaa.aaa.aa�����yGFILE0��l8��`H�y���y��v�R��v�R�� �0xZ1�y��O�t�R��O�t�R��O�t�R��