Re: file recovery

http://www.grc.com/sr/spinrite.htm - Steve Gibson's SpinRite works on linux
partitions but you'd need to buy the software and connect your drive to an
XP box to use it ... from what I've heard this is one of the best forensic
tools out there (and if Mr. Gibson's other work out there is any indication
the man's a freaking genius) ... just thought I'd throw that out there :)

On 9/5/07, Dave Hall <dave-slg@dnh.sk.ca> wrote:
>
> On Wed, Sep 05, 2007 at 04:23:18PM -0600, rob wrote:
> > Aaaaaaaaaaaaaggghhhh
> >
> > I just rsync --delete(etd) some files any tools out there to help me do
> > file recovery?
>
> Step 0, First try recovering from reliable off-line backup.
>
> Is the information worth enough to spend potentially several hours re-
> assembling the files ... if yes, continue:
>
> Step 1, capture a snapshot of the the physical media ASAP. The longer
> there is for stuff to be overwritten, the less chance of recovery.
>
> Step 2, find a forensic tool that will look for blocks that look like
> inodes and attempt to recreate a model of the possible files.
>
> Step 3, go through the results and attempt to recover the files. This is
> relatively easy with text files where you know or would recognize the
> content. Binary files would need more analysis.
>
> I think the tool I used a few yeara back was The Coroner's Toolkit (TCT).
> It was a PITA but successfull for some e-mail that I deleted accidentally.
>
> http://www.porcupine.org/forensics/tct.html
>
> http://www.fish2.com/tct/help-recovering-file
>
> --
>
> Dave
>
>
> --
> I'm interested in upgrading my 28.8 kilobaud internet connection to a
> 1.5 megabit fiberoptic T1 line. Will you be able to provide an IP
> router that's compatible with my token ring ethernet LAN configuration?
>
> To unsubscribe, send a message with the word "unsubscribe" (without the
> quotes) in the body to linux-request@slg.org
> Archives are at http://list.slg.org/
>
Received on Wed Sep 5 17:47:19 2007