3 Jun
2008
3 Jun
'08
11:31 a.m.
Last week the hard disk of my PC crashed. After it has been formatted, I realized that not
all data
had been saved. Is there a way to recover them now?
3 Jun
3 Jun
12:07 p.m.
Hi,
On Tue, Jun 03, 2008 at 01:31:04PM +0200, Jean-Paul Piazzolla wrote:
Last week the hard disk of my PC crashed. After it has
been formatted, I realized that not all data
had been saved. Is there a way to recover them now?
As the disk has been written over, chances are slim. If the
formatting was of the "light" variant, i.e. no complete check
of the disk but only generating the filesystem, there may be
many blocks still holding the original data. Thus, if you
copy the entire disk contents (via dd), forensic tools might
help you reconstruct some data.
http://www.opensourceforensics.org/tools/unix.html
http://www.sleuthkit.org/
Greetings & good luck, Eric
1:50 p.m.
-------- Message original --------
Sujet: [Lilux-help] data recover
De: Jean-Paul Piazzolla <jp.piazzolla(a)yesacademy.lu>
Pour: lilux-help(a)lilux.lu
Date: 03.06.2008 13:31
a few more information can be interesting :)
- initial filesystem ?
- actual filesystem ? (the same I guess ?)
- only format or format AND reinstall ?
Recover what ?
- files from known type ?
- files from known name ?
- all files if possible ?
by example:
- initial NTFS
- actual Mac FS (don't remember name)
- 18Gb overwriten
with Ubuntu: apt-get install magicrescue and:
magicrescue -r jpeg-exif -d ~/output /dev/sdb
give me back about 1 300 pictures from 3 000 initial
Not too bad I guess :) :) :)
Good day,
Laurent.
--
Lorsqu'on s'occupe d'informatique il faut faire comme les canards...
Paraître calme en surface et pédaler comme un forcené par en-dessous
6173
days inactive
6173
days old
2 comments
3 participants
participants (3)
-
Eric Dondelinger -
Jean-Paul Piazzolla -
Laurent Bohnert