+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Data Recovery Software (/showthread.php?tid=4006980)
Data Recovery Software - dark.coder - Jan 19, 2014
I am looking for a Data Recovery Software for Forensic Use.
There are lot's of Software but i want to get good one.
That software will give me Those data has deleted and Also Folder that has deleted.
Thank you.
* - SIM-5561 - Jan 19, 2014
Why forensic use? Why not just use the likes of Recuva? EnCase can help but unless you work in the field you wont have access to it.
* - poverello78 - Jan 22, 2014
Try R-Studio for general recovery, it's extraordinarily powerful. And Adroit Photo Forensics for photo recovery/carving/repair.
* - CoinCoin - Jan 22, 2014
Thanls you for tha reference !
I use recuva too !
* - happyhaxor - Jan 22, 2014
You catually dont need a special software. mout your image write blocked and then run the software on it. you will not have any issies.
* - Goodies - Jan 22, 2014
Note that often times, when data is deleted, it's not actually "deleted". Just able to be written over by other files.
HDD analysis will show that many of your files can be retreived... I would mount the filesystem and "dd" it to another drive for further analysis. You can boot the resulting .img or .iso file in Virtualbox and have a mirrored copy of the origial drive. I would recommend saving/compressing one as backup... There are dozens of open source analysis tools for forensics in both windows and linux :)
* - SIM-5561 - Jan 22, 2014
(Jan 22, 2014 03:24 PM)Goodies Wrote: Note that often times, when data is deleted, it's not actually "deleted". Just able to be written over by other files.
HDD analysis will show that many of your files can be retreived... I would mount the filesystem and "dd" it to another drive for further analysis. You can boot the resulting .img or .iso file in Virtualbox and have a mirrored copy of the origial drive. I would recommend saving/compressing one as backup... There are dozens of open source analysis tools for forensics in both windows and linux :)
As Goodies said, it becomes part of thr 'unallocated' space. DD is a great way of doing it however rather than boot the image, i'd personally open it with forensic software. Depends what the context is for the OP I guess.