Daily Blog #614: Forensic Lunch Test Kitchen 1/31/19 Deep Freeze Windows 10

Deep Freeze Windows 10 - David Cowen Hacking Exposed Computer Forensics


Hello Reader,
        Tonight we continued testing Deep Freeze on Windows 10 to find out what data was recoverable and how or if the data had been changed. Here is what we learned:

  • The deleted data appears not just to be partially overwritten but moved physically on the disk
  • When new data is written the older data from a prior reboot may be overwritten if the new data is larger
  • If the subsequent reboots contain smaller amounts of new data, then older data from past reboots will survive

You can watch the video here:



Also Read: Daily Blog #613

Post a Comment