close

Privacy guaranteed - Your email is not shared with anyone.

Forensic data recovery

Discussion in 'Tech Talk' started by Green_Manelishi, Jun 10, 2010.

  1. Green_Manelishi

    Green_Manelishi Knicker Knotter

    Joined:
    May 4, 2006
    Messages:
    4,716
    Likes Received:
    0
    Location:
    On the edge but not quite over ...
    the son of the boyfriend of the woman for whom my wife works was allowed access to the company PC. Allegedly he was helping to merge data from a few systems. To make a long story short, he reformatted the drive then reinstalled XP. The PC is clean; no files, no software. Nothing except XP.

    Research, and discussions over the years, indicate it is possible to recover the data. Any recommendations for how to proceed? Or should they prepare themselves for hours of data entry?
     
    Last edited: Jun 10, 2010
  2. cgwahl

    cgwahl Sheriffs a near

    Joined:
    Feb 15, 2002
    Messages:
    6,670
    Likes Received:
    966
    Location:
    CA
    Slave the drive and give this a shot: http://www.piriform.com/recuva

    There are others, possibly better. But it's free and easy to use. However, you can also find Hiren's Boot CD for others.


    You are probably not going to find everything though since while it might be recoverable from just doing a format...the reinstalling windows will have overwrited areas of the drive the file might have been stored on.
     

  3. MavsX

    MavsX The Dude Abides

    Joined:
    Jan 19, 2009
    Messages:
    3,033
    Likes Received:
    0
    Location:
    Arlington, VA
  4. mitchshrader

    mitchshrader Deceased

    Joined:
    Jun 14, 2005
    Messages:
    8,672
    Likes Received:
    5
    Location:
    Tulsa
    this is why you make back ups. they should give him 100$.
     
  5. BirdDog239

    BirdDog239 Sheep Dog

    Joined:
    Feb 2, 2009
    Messages:
    83
    Likes Received:
    0
    Location:
    Ohio
    It depends what type of files that you are trying to recover. If you looking for word documents, spread sheets or photos then you may want to consider using photorec.

    What you would do is hook the hard drive to second computer. Then select the types of files that you want to recover and save all recovered files to the any drive but the one that you are trying to recover data from. PhotoRec looks for file header information and it will try to data carve the file out. The problem with any method is that the original file names are going to be gone and you may find old draft copies of your documents.

    It also works on digital cameras, or flash drives and it is free.

    http://www.cgsecurity.org/wiki/PhotoRec
     
    Last edited: Jun 10, 2010
  6. Green_Manelishi

    Green_Manelishi Knicker Knotter

    Joined:
    May 4, 2006
    Messages:
    4,716
    Likes Received:
    0
    Location:
    On the edge but not quite over ...
    Backups? :rofl:

    Give him $100? For what?
     
  7. Drjones

    Drjones

    Joined:
    Sep 28, 2002
    Messages:
    6,157
    Likes Received:
    54
    Location:
    CA, just outside the United States
    I've had great luck with software by Easeus. Google it.
     
  8. unit 900

    unit 900

    Joined:
    Sep 3, 2000
    Messages:
    756
    Likes Received:
    101
    Location:
    Baltimore, Md
    These folks say that their product can recover data from a reformatted drive. They offer a free download that lets you see the files that may be recovered. Needless to say, you need to buy the product to actually do the recovery. Looks interesting, and the price seems reasonable given the risk of losing your old data. Good luck:
    http://www.recovermyfiles.com/

    I've never used this, just came across it in my wasted time on the Internet.
     
  9. dotsun

    dotsun Shark Stomper

    Joined:
    Mar 25, 2007
    Messages:
    1,220
    Likes Received:
    43
    Location:
    Knoxville, TN
    I've used Autopsy with mixed results. It's free on the Backtrack iso.