Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 26 guests online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow It's time to get that data back!
EH-Net
May 19, 2013, 02:45:38 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: It's time to get that data back!  (Read 6562 times)
0 Members and 1 Guest are viewing this topic.
xXxKrisxXx
Hero Member
*****
Offline Offline

Posts: 512



View Profile
« on: November 18, 2008, 10:51:43 AM »

Sup E-H.net,

I haven't really touched Helix and figured some of you may have some exp in this area. I'm looking to get back some files that were deleted by a complete install of an OS. Can someone name a few tools, tutorials, links on these bad boys so I can read up on them. Had a buddy come to me the other day, I don't really want to let him down and all. Thanks in advanced for your replies.
Logged

eCPPT, GCIH, OSCP, OSWP
jimbob
Guest
« Reply #1 on: November 18, 2008, 10:59:55 AM »

Hi,
The first thing to do is stop any more writes happening to the disk. Power off the system so that no further data will be lost. Make an image of the disk and work on a copy so you don't risk losing any more data.

There are tools to recover deleted files. Check out The Sleuth Kit (TSK) and autopsy for a free way of examining file systems. A reinstall of the OS probably means that you've formatted the system volume, so this won't be a simple case of finding deleted files in the current file system. A data carving tool like foremost might be your best bet in recovering files.

Can you let us know the OS, file system type (before and after installation) and the type of files you are trying to recover?

Regards,
Jimbob
Logged
xXxKrisxXx
Hero Member
*****
Offline Offline

Posts: 512



View Profile
« Reply #2 on: November 18, 2008, 01:55:47 PM »

Yeah, it's Vista Home Premium. I'm looking at it right now though and it looks like he installed vista right over top of it. I looked in his C:\ to find a C:\Windows and a C:\Windows.old folder. Looks as if I don't have to go through with this. The couple tools you named are definitely worth me looking into so I'm going to look at those soon. Thanks for your quick response btw, always good to know this forum has my back.
Logged

eCPPT, GCIH, OSCP, OSWP
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #3 on: November 18, 2008, 11:34:51 PM »

Foremost is an awesome tool.  I really think its data carving ability beats most of the commercial tools.   

One thing you can try is a couple of inexpensive tools that do a search for lost partitions.   You may be lucky and be able to recreate the lost partition.  TestDisk is one such tool.   I have used it before with much success.   If you have access to EnCase or X-Ways Forensics, they both have some nice tools for recovering data.
Logged

~~~~~~~~~~~~~~
Ketchup
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #4 on: November 19, 2008, 09:03:56 AM »

Glary Utilities is free and has file recovery abilities as well. Good luck,
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
jason
Hero Member
*****
Offline Offline

Posts: 1012



View Profile WWW
« Reply #5 on: February 11, 2009, 09:48:51 PM »

Were you ever able to get the files back Kris?
Logged
xXxKrisxXx
Hero Member
*****
Offline Offline

Posts: 512



View Profile
« Reply #6 on: February 12, 2009, 12:58:29 AM »

Yeah bud, Looks as if they were in that Windows.old folder, lucky I ended up looking there.
Logged

eCPPT, GCIH, OSCP, OSWP
SynJunkie
Jr. Member
**
Offline Offline

Posts: 71


View Profile WWW
« Reply #7 on: February 12, 2009, 07:02:59 AM »

Kris

Regarding tools on Helix, there is a tool for file recovery called PC Inspector thats on the Helix CD.  I cover it's usage (in a basic way) in a blog post I made a while back.

http://synjunkie.blogspot.com/2008/12/story-of-insider-part-3-playing-at-csi.html

This might be of interest for the future.

Regards

Syn
Logged

----------------------------------
http://synjunkie.blogspot.com
timmedin
Sr. Member
****
Offline Offline

Posts: 469



View Profile WWW
« Reply #8 on: February 14, 2009, 01:38:19 PM »

Kris

Regarding tools on Helix, there is a tool for file recovery called PC Inspector thats on the Helix CD.  I cover it's usage (in a basic way) in a blog post I made a while back.

http://synjunkie.blogspot.com/2008/12/story-of-insider-part-3-playing-at-csi.html

This might be of interest for the future.

Regards

Syn


I'll second Helix as a free tool.
Logged

twitter.com/timmedin | http://blog.securitywhole.com
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.08 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.