Description
This module lists and attempts to recover deleted files from NTFS file systems. Use the FILES option to guide recovery. Leave this option empty to enumerate deleted files in the DRIVE. Set FILES to an extension (e.g., "pdf") to recover deleted files with that extension, or set FILES to a comma separated list of IDs (from enumeration) to recover those files. The user must have account file enumeration. Recovery may take a long time; use the TIMEOUT option to abort enumeration or recovery by extension after a specified period (in seconds).
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use post/windows/gather/forensics/recovery/filesmsf undefined(files) > show actions ...actions...msf undefined(files) > set ACTION < action-name >msf undefined(files) > show options ...show and set options...msf undefined(files) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub