home | list info | list archive | date index | thread index

Re: [OCLUG-Tech] Friend installed Linux - then ripped out WindowsXP: He needs help ??

  • Subject: Re: [OCLUG-Tech] Friend installed Linux - then ripped out WindowsXP: He needs help ??
  • From: "Jacques B." <jjrboucher [ at ] gmail [ dot ] com>
  • Date: Tue, 23 May 2006 14:09:28 -0300
Foremost is an open source Linux tool for data recovery (you can get
it from Sourceforge.net).  You can also go grab Knoppix STD
(www.s-t-d.org) and use Autopsy to do data recovery.  And Helix
(www.e-fense.com/helix) is another great Linux forensic boot CD based
on Knoppix.

Proper forensics dictate that you do not work on the original, but
rather on a copy (so make a dd image of the original onto another
drive).  For home use that may not be an option or necessary.  But you
definitely do not want to recover back to the same partition as you do
not want to overwrite existing data.  Mounting your partition
read-only (or not mounting at all and running tools against the
physical device or partition) will protect your data from being
overwritten.

Whatever you do, don't put it into a regular drive enclosure and then
connect it to a MS Windows box to run tools against it.  Windows will
want to put a recycle bin on it, and unless a forensically sound tool
it will try and recover the data back on the same disk.