rapid7/metasploit-framework — pull request #1687 by bmerinofe (2013-03-30 01:06:04+00:00)
Title: added post module forensics recovery files

This module list and try to recover deleted files from NTFS file systems. To get this It will read and parse each of the $MFT entries to locate deleted files. If the file is fragmented It will get the dataruns and save them to disk. If the file is resident It will take the content directly from the MFT entry.

The process to go through the entire MFT could be really slow (hours) in a big drive with many files (in my tests It takes about 8-10 entries/files per second) so I recommend to check it with a modest NTFS formated pen-drive. Note that the recovered file could be corrupted because the content has been totally or partially overwritten. Here's a simple video about how it works http://www.youtube.com/watch?v=9yzCf360ujY&hd=1