Topic: Recovering Deleted Data from and Excel Spreadsheet
I am currently tasked with recapturing intentionally deleted data from an excel spread sheet. After imaging the subject hard drive using dd and mounting that image in Autopsy, I was unpleasantly surprised to see that the files my company had asked me to recover had not been deleted at all but rather the data inside the files (spreadsheets) had been deleted and resaved.
I am unsure how to proceed at this point, where would such deleted data go? Slack or unallocated? If slack, I don't think I can retrieve it using Autopsy. If it's in unallocated somewhere, how would I go about pin-pointing the data that was once associated with the file/inode/clusters?
The suspect OS was Windows XP, the version of Office being run was 2003.
Can anyone help shed some light on this problem???