File recovery approaches:

**MFT-based recovery:** If the MFT entry still exists, the file metadata is intact even though the file is "deleted" - **File carving:** Searching raw disk data for file signatures (magic bytes) to recover files without file system metadata - **Slack space analysis:** Examining the space between the