Recover Data Like a Forensics Expert Using an Ubuntu Live CD

[begood]

Plenty of utilities can recover deleted files, but what if you can't boot your computer, or the whole drive has been formatted? Here's how to dig deep and recover the most elusive deleted files, or even whole partitions.

We've shown you simple ways to recover accidentally deleted files, even a simple method that can be done from an Ubuntu Live CD, but for hard disks that have been heavily corrupted, those methods aren't going to cut it. In this article, we'll examine four tools that can recover data from the most messed up hard drives, regardless of whether they were formatted for a Windows, Linux, or Mac computer, or even if the partition table is wiped out entirely.

Note: These tools cannot recover data that has been overwritten on a hard disk. Whether a deleted file has been overwritten depends on many factors – the quicker you realize that you want to recover a file, the more likely you will be able to do so.

Our setup

To show these tools, we've set up a small 1 GB hard drive, with half of the space partitioned as ext2, a file system used in Linux, and half the space partitioned as FAT32, a file system used in older Windows systems. We stored ten random pictures on each hard drive.

We then wiped the partition table from the hard drive by deleting the partitions in GParted.

Is our data lost forever?

Installing the tools

All of the tools we're going to use are in Ubuntu's universe repository.

To enable the repository, open Synaptic Package Manager by clicking on System in the top-left, then Administration > Synaptic Package Manager.

Click on Settings > Repositories and add a check in the box labelled "Community-maintained Open Source software (universe)".

Click Close, and then in the main Synaptic Package Manager window, click the Reload button. Once the package list has reloaded, and the search index rebuilt, search for and mark for installation one or all of the following packages: testdisk, foremost, and scalpel.

Testdisk includes TestDisk, which can recover lost partitions and repair boot sectors, and PhotoRec, which can recover many different types of files from tons of different file systems.

Finally, scalpel performs the same functions as foremost, but is focused on enhanced performance and lower memory usage. Scalpel may run better if you have an older machine with less RAM.

more : http://lifehacker.com/5525534/recover-data-like-a-forensics-expert-using-an-ubuntu-live-cd

[adonisslanic]

Oare cu Backtrack nu poti sa faci chestii la fel de interesante si mai eficient? ca are si el liveCD

[prodil89]

Mda poate dar de ce sunteti asa obsedati de backtrack?Sunt live-cd-uri mult mai mijto...depinde ce cauti...