Forensic data recovery [Archive] - Glock Talk


View Full Version : Forensic data recovery

06-10-2010, 15:43
the son of the boyfriend of the woman for whom my wife works was allowed access to the company PC. Allegedly he was helping to merge data from a few systems. To make a long story short, he reformatted the drive then reinstalled XP. The PC is clean; no files, no software. Nothing except XP.

Research, and discussions over the years, indicate it is possible to recover the data. Any recommendations for how to proceed? Or should they prepare themselves for hours of data entry?

06-10-2010, 16:21
Slave the drive and give this a shot:

There are others, possibly better. But it's free and easy to use. However, you can also find Hiren's Boot CD for others.

You are probably not going to find everything though since while it might be recoverable from just doing a format...the reinstalling windows will have overwrited areas of the drive the file might have been stored on.

06-10-2010, 17:10

06-10-2010, 17:37
this is why you make back ups. they should give him 100$.

06-10-2010, 17:52
It depends what type of files that you are trying to recover. If you looking for word documents, spread sheets or photos then you may want to consider using photorec.

What you would do is hook the hard drive to second computer. Then select the types of files that you want to recover and save all recovered files to the any drive but the one that you are trying to recover data from. PhotoRec looks for file header information and it will try to data carve the file out. The problem with any method is that the original file names are going to be gone and you may find old draft copies of your documents.

It also works on digital cameras, or flash drives and it is free.

06-10-2010, 17:57
this is why you make back ups. they should give him 100$.

Backups? :rofl:

Give him $100? For what?

06-11-2010, 00:05
I've had great luck with software by Easeus. Google it.

unit 900
06-11-2010, 17:49
These folks say that their product can recover data from a reformatted drive. They offer a free download that lets you see the files that may be recovered. Needless to say, you need to buy the product to actually do the recovery. Looks interesting, and the price seems reasonable given the risk of losing your old data. Good luck:

I've never used this, just came across it in my wasted time on the Internet.

06-12-2010, 04:57
I've used Autopsy with mixed results. It's free on the Backtrack iso.