The Ethical Hacker Network - It's time to get that data back!

Latest Additions

Who's Online

EH-Net News Feeds

Latest Additions

xXxKrisxXx

Sr. Member

Offline

Posts: 491

It's time to get that data back!

« on: November 18, 2008, 10:51:43 AM »

Sup E-H.net,

I haven't really touched Helix and figured some of you may have some exp in this area. I'm looking to get back some files that were deleted by a complete install of an OS. Can someone name a few tools, tutorials, links on these bad boys so I can read up on them. Had a buddy come to me the other day, I don't really want to let him down and all. Thanks in advanced for your replies.


	Logged

OSCP, OWSP, eCPPT

jimbob

Guest

Re: It's time to get that data back!

« Reply #1 on: November 18, 2008, 10:59:55 AM »

Hi,
The first thing to do is stop any more writes happening to the disk. Power off the system so that no further data will be lost. Make an image of the disk and work on a copy so you don't risk losing any more data.

There are tools to recover deleted files. Check out The Sleuth Kit (TSK) and autopsy for a free way of examining file systems. A reinstall of the OS probably means that you've formatted the system volume, so this won't be a simple case of finding deleted files in the current file system. A data carving tool like foremost might be your best bet in recovering files.

Can you let us know the OS, file system type (before and after installation) and the type of files you are trying to recover?

Regards,
Jimbob


	Logged

xXxKrisxXx

Sr. Member

Offline

Posts: 491

Re: It's time to get that data back!

« Reply #2 on: November 18, 2008, 01:55:47 PM »

Yeah, it's Vista Home Premium. I'm looking at it right now though and it looks like he installed vista right over top of it. I looked in his C:\ to find a C:\Windows and a C:\Windows.old folder. Looks as if I don't have to go through with this. The couple tools you named are definitely worth me looking into so I'm going to look at those soon. Thanks for your quick response btw, always good to know this forum has my back.


	Logged

OSCP, OWSP, eCPPT

Ketchup

Hero Member

Offline

Posts: 1006

Re: It's time to get that data back!

« Reply #3 on: November 18, 2008, 11:34:51 PM »

Foremost is an awesome tool. I really think its data carving ability beats most of the commercial tools.

One thing you can try is a couple of inexpensive tools that do a search for lost partitions. You may be lucky and be able to recreate the lost partition. TestDisk is one such tool. I have used it before with much success. If you have access to EnCase or X-Ways Forensics, they both have some nice tools for recovering data.


	Logged

~~~~~~~~~~~~~~
Ketchup

sgt_mjc

Sr. Member

Offline

Posts: 294

Re: It's time to get that data back!

« Reply #4 on: November 19, 2008, 09:03:56 AM »

Glary Utilities is free and has file recovery abilities as well. Good luck,


	Logged

Mike Conway
CISSP
CompTia Security +
C|EH

jason

Hero Member

Offline

Posts: 945

Re: It's time to get that data back!

« Reply #5 on: February 11, 2009, 09:48:51 PM »

Were you ever able to get the files back Kris?


	Logged

xXxKrisxXx

Sr. Member

Offline

Posts: 491

Re: It's time to get that data back!

« Reply #6 on: February 12, 2009, 12:58:29 AM »

Yeah bud, Looks as if they were in that Windows.old folder, lucky I ended up looking there.


	Logged

OSCP, OWSP, eCPPT

SynJunkie

Jr. Member

Offline

Posts: 71

Re: It's time to get that data back!

« Reply #7 on: February 12, 2009, 07:02:59 AM »

Kris

Regarding tools on Helix, there is a tool for file recovery called PC Inspector thats on the Helix CD. I cover it's usage (in a basic way) in a blog post I made a while back.

http://synjunkie.blogspot.com/2008/12/story-of-insider-part-3-playing-at-csi.html

This might be of interest for the future.

Regards

Syn