September 21st, 2003, 10:54 PM
Recovering Deleted Data
This isn't mission critical data that I'm recovering, it's a few gigs of movies and mp3's.
I'm attempting to recover data from a laptop that has had the operating system re-installed.
The data, along with windows was wiped out on a laptop and since, a technicain reinstalled the OS, before I had a chance to attempt to recover files with an undeletion tool.
I'm sure the data has been written over, but only once. I know for it needs to be written over at least a few times before it's complete gone.
I have at my disposal a linux workstation and the ability to install any recommend software.
The victim computer is a w2k laptop.
The tools has to be an open-source solution, or at the least if it has to be windows, free solution to recovering the files.
I'm willing to try any tools that meet the criteria.
September 21st, 2003, 11:02 PM
I'm thinking that you will be extremely lucky to find a free solution for windows - most undelete programs for windows cost $$ (and even then a lot of them won't undelete after an OS reinstall.)
A quick search of google turned up this
got no idea if the free trial is any good or even if the program is any good but it sounds like what you need
also just found this one
you might want to check google for any other options
Quis Custodiet Ipsos Custodes
September 21st, 2003, 11:45 PM
Thanks zonewalker, I'll look into those tools. You've got a nice site ( www.zonewalker.net )by the way. I'd love to have your pics in my site's photo gallery ( stop by).
September 22nd, 2003, 02:57 PM
Try PC Inspector file recovery,might work.Good luck
September 22nd, 2003, 05:58 PM
There two tools might come in handy, I learned about them from project.honeynet.org
TASK (The @stake Sleuth Kit) and Autopsy (graphical frontend to TASK)
It does involve some knowledge about file-headers though.
TASK can be found @ http://www.atstake.com/research/tools/task/index.html
Autopsy @ http://www.atstake.com/research/tool...psy/index.html
TASK is a collection of open source, command line tools based on The
Coroner's Toolkit (TCT) and TCTUTILs. Using these tools, an investigator
can view the details of NTFS, FAT, FFS, and EXT2FS file systems.
TASK gives an investigator access to details that other tools do not,
which can be used for advanced file recovery. TASK is the only open
source collection of tools for both Windows and UNIX file systems that
allow one to view both allocated and unallocated files.