[dark.coder]

I am looking for a Data Recovery Software for Forensic Use.
There are lot's of Software but i want to get good one.
That software will give me Those data has deleted and Also Folder that has deleted.
Thank you.

[SIM-5561]

Why forensic use? Why not just use the likes of Recuva? EnCase can help but unless you work in the field you wont have access to it.

[poverello78]

Try R-Studio for general recovery, it's extraordinarily powerful. And Adroit Photo Forensics for photo recovery/carving/repair.

[CoinCoin]

Thanls you for tha reference !
I use recuva too !

[happyhaxor]

You catually dont need a special software. mout your image write blocked and then run the software on it. you will not have any issies.

[Goodies]

Note that often times, when data is deleted, it's not actually "deleted". Just able to be written over by other files.

HDD analysis will show that many of your files can be retreived... I would mount the filesystem and "dd" it to another drive for further analysis. You can boot the resulting .img or .iso file in Virtualbox and have a mirrored copy of the origial drive. I would recommend saving/compressing one as backup... There are dozens of open source analysis tools for forensics in both windows and linux :)

[SIM-5561]

Note that often times, when data is deleted, it's not actually "deleted". Just able to be written over by other files.

HDD analysis will show that many of your files can be retreived... I would mount the filesystem and "dd" it to another drive for further analysis. You can boot the resulting .img or .iso file in Virtualbox and have a mirrored copy of the origial drive. I would recommend saving/compressing one as backup... There are dozens of open source analysis tools for forensics in both windows and linux :)

As Goodies said, it becomes part of thr 'unallocated' space. DD is a great way of doing it however rather than boot the image, i'd personally open it with forensic software. Depends what the context is for the OP I guess.