.

It's time to get that data back!

<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Tue Nov 18, 2008 11:51 am

It's time to get that data back!

Sup E-H.net,

I haven't really touched Helix and figured some of you may have some exp in this area. I'm looking to get back some files that were deleted by a complete install of an OS. Can someone name a few tools, tutorials, links on these bad boys so I can read up on them. Had a buddy come to me the other day, I don't really want to let him down and all. Thanks in advanced for your replies.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

jimbob

Post Tue Nov 18, 2008 11:59 am

Re: It's time to get that data back!

Hi,
The first thing to do is stop any more writes happening to the disk. Power off the system so that no further data will be lost. Make an image of the disk and work on a copy so you don't risk losing any more data.

There are tools to recover deleted files. Check out The Sleuth Kit (TSK) and autopsy for a free way of examining file systems. A reinstall of the OS probably means that you've formatted the system volume, so this won't be a simple case of finding deleted files in the current file system. A data carving tool like foremost might be your best bet in recovering files.

Can you let us know the OS, file system type (before and after installation) and the type of files you are trying to recover?

Regards,
Jimbob
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Tue Nov 18, 2008 2:55 pm

Re: It's time to get that data back!

Yeah, it's Vista Home Premium. I'm looking at it right now though and it looks like he installed vista right over top of it. I looked in his C:\ to find a C:\Windows and a C:\Windows.old folder. Looks as if I don't have to go through with this. The couple tools you named are definitely worth me looking into so I'm going to look at those soon. Thanks for your quick response btw, always good to know this forum has my back.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Wed Nov 19, 2008 12:34 am

Re: It's time to get that data back!

Foremost is an awesome tool.  I really think its data carving ability beats most of the commercial tools. 

One thing you can try is a couple of inexpensive tools that do a search for lost partitions.  You may be lucky and be able to recreate the lost partition.  TestDisk is one such tool.  I have used it before with much success.  If you have access to EnCase or X-Ways Forensics, they both have some nice tools for recovering data.
~~~~~~~~~~~~~~
Ketchup
<<

sgt_mjc

Sr. Member
Sr. Member

Posts: 294

Joined: Tue Feb 05, 2008 8:34 am

Location: AL

Post Wed Nov 19, 2008 10:03 am

Re: It's time to get that data back!

Glary Utilities is free and has file recovery abilities as well. Good luck,
Mike Conway
CISSP
CompTia Security +
C|EH
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Wed Feb 11, 2009 10:48 pm

Re: It's time to get that data back!

Were you ever able to get the files back Kris?
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Thu Feb 12, 2009 1:58 am

Re: It's time to get that data back!

Yeah bud, Looks as if they were in that Windows.old folder, lucky I ended up looking there.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

SynJunkie

Jr. Member
Jr. Member

Posts: 71

Joined: Thu Apr 17, 2008 2:41 pm

Location: UK

Post Thu Feb 12, 2009 8:02 am

Re: It's time to get that data back!

Kris

Regarding tools on Helix, there is a tool for file recovery called PC Inspector thats on the Helix CD.  I cover it's usage (in a basic way) in a blog post I made a while back.

http://synjunkie.blogspot.com/2008/12/s ... t-csi.html

This might be of interest for the future.

Regards

Syn
----------------------------------
http://synjunkie.blogspot.com
<<

timmedin

User avatar

Sr. Member
Sr. Member

Posts: 469

Joined: Thu Feb 05, 2009 11:18 pm

Post Sat Feb 14, 2009 2:38 pm

Re: It's time to get that data back!

SynJunkie wrote:Kris

Regarding tools on Helix, there is a tool for file recovery called PC Inspector thats on the Helix CD.  I cover it's usage (in a basic way) in a blog post I made a while back.

http://synjunkie.blogspot.com/2008/12/s ... t-csi.html

This might be of interest for the future.

Regards

Syn



I'll second Helix as a free tool.
twitter.com/timmedin | http://blog.securitywhole.com

Return to Forensics

Who is online

Users browsing this forum: No registered users and 2 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software