Did the source computer hard disk drive contain two copies of the same graphics file or is this tied to some technical graphics image issue?
Once a relevant file has been identified, e.g., in a child pornography case, using Graphics File Extractor software, then the first 40 bytes of the file should be used to search for the source data in the unallocated storage space of the subject computer storage device. This search can easily be done with NTI’s HexSearch software. Once the relevant clusters have been identified, then they can manually be restored by the computer forensics specialist.