19 Dec
2008
19 Dec
'08
2:52 p.m.
On 19/12/2008 11:37:01, Wayne Stallwood wrote:
On Fri, 2008-12-19 at 11:12 +0000, Mark Rogers wrote:
Try Photorec http://www.cgsecurity.org/wiki/PhotoRec it is probably in your favourite distro's package repository (on ubuntu and debian it is in the testdisk package)
It works very well even if the partition information etc is lost as it just looks for recognisable file headers.
We had a talk at work a while back now from somebody from the police forensics team and the software they use to find things you shouldn't have or which may be useful evidence uses exactly this technique in case you have deleted the files or used a filesystem that the software cannot otherwise cope with.
Regards, Steve.