Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 21 guests and 2 members online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow It's time to get that data back!
Ethical Hacker Community Forums
January 09, 2009, 06:26:05 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2009 - May 4 - 9. Boot Camps & an Ethical Hacking Conf. www.chicagocon.com
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: It's time to get that data back!  (Read 1352 times)
0 Members and 1 Guest are viewing this topic.
KrisTeason
Full Member
***
Offline Offline

Posts: 118


View Profile
« on: November 18, 2008, 10:51:43 AM »

Sup E-H.net,

I haven't really touched Helix and figured some of you may have some exp in this area. I'm looking to get back some files that were deleted by a complete install of an OS. Can someone name a few tools, tutorials, links on these bad boys so I can read up on them. Had a buddy come to me the other day, I don't really want to let him down and all. Thanks in advanced for your replies.
Logged
jimbob
Sr. Member
****
Offline Offline

Posts: 333



View Profile WWW
« Reply #1 on: November 18, 2008, 10:59:55 AM »

Hi,
The first thing to do is stop any more writes happening to the disk. Power off the system so that no further data will be lost. Make an image of the disk and work on a copy so you don't risk losing any more data.

There are tools to recover deleted files. Check out The Sleuth Kit (TSK) and autopsy for a free way of examining file systems. A reinstall of the OS probably means that you've formatted the system volume, so this won't be a simple case of finding deleted files in the current file system. A data carving tool like foremost might be your best bet in recovering files.

Can you let us know the OS, file system type (before and after installation) and the type of files you are trying to recover?

Regards,
Jimbob
Logged
KrisTeason
Full Member
***
Offline Offline

Posts: 118


View Profile
« Reply #2 on: November 18, 2008, 01:55:47 PM »

Yeah, it's Vista Home Premium. I'm looking at it right now though and it looks like he installed vista right over top of it. I looked in his C:\ to find a C:\Windows and a C:\Windows.old folder. Looks as if I don't have to go through with this. The couple tools you named are definitely worth me looking into so I'm going to look at those soon. Thanks for your quick response btw, always good to know this forum has my back.
Logged
Ketchup
Newbie
*
Offline Offline

Posts: 47


View Profile
« Reply #3 on: November 18, 2008, 11:34:51 PM »

Foremost is an awesome tool.  I really think its data carving ability beats most of the commercial tools.   

One thing you can try is a couple of inexpensive tools that do a search for lost partitions.   You may be lucky and be able to recreate the lost partition.  TestDisk is one such tool.   I have used it before with much success.   If you have access to EnCase or X-Ways Forensics, they both have some nice tools for recovering data.
Logged
sgt_mjc
Full Member
***
Offline Offline

Posts: 167


View Profile
« Reply #4 on: November 19, 2008, 09:03:56 AM »

Glary Utilities is free and has file recovery abilities as well. Good luck,
Logged

Mike Conway
CompTia Security +
C|EH
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2007, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.041 seconds with 22 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
How many security events including conferences and training do you attend a year:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2009 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.