Re: file recovery

On Wed, Sep 05, 2007 at 04:23:18PM -0600, rob wrote:
> Aaaaaaaaaaaaaggghhhh
>
> I just rsync --delete(etd) some files any tools out there to help me do
> file recovery?

Step 0, First try recovering from reliable off-line backup.

Is the information worth enough to spend potentially several hours re-
assembling the files ... if yes, continue:

Step 1, capture a snapshot of the the physical media ASAP. The longer
there is for stuff to be overwritten, the less chance of recovery.

Step 2, find a forensic tool that will look for blocks that look like
inodes and attempt to recreate a model of the possible files.

Step 3, go through the results and attempt to recover the files. This is
relatively easy with text files where you know or would recognize the
content. Binary files would need more analysis.

I think the tool I used a few yeara back was The Coroner's Toolkit (TCT).
It was a PITA but successfull for some e-mail that I deleted accidentally.

http://www.porcupine.org/forensics/tct.html

http://www.fish2.com/tct/help-recovering-file
Received on Wed Sep 5 17:40:37 2007