(Ted Harding) wrote:
On 19-Dec-08 15:51:12, Ian Thompson-Bell wrote:
Steve Fosdick wrote:
On 19/12/2008 11:37:01, Wayne Stallwood wrote:
On Fri, 2008-12-19 at 11:12 +0000, Mark Rogers wrote: Try Photorec http://www.cgsecurity.org/wiki/PhotoRec it is probably in your favourite distro's package repository (on ubuntu and debian it is in the testdisk package)
It works very well even if the partition information etc is lost as it just looks for recognisable file headers.
We had a talk at work a while back now from somebody from the police forensics team and the software they use to find things you shouldn't have or which may be useful evidence uses exactly this technique in case you have deleted the files or used a filesystem that the software cannot otherwise cope with.
It seems to be called testdisk under Ubuntu. Cheers Ian
Hmmm ... not sure if that's correct! Couldn't find PhotoRec in Debian, but did find testdisk, which is described as:
Partition scanner and disk recovery tool TestDisk checks the partition and boot sectors of your disks. It is very useful in recovering lost partitions.
No reference to having anything to do with searching for files!
See also: http://en.wikipedia.org/wiki/TestDisk Ted.
Interesting because I did a synaptic search for photorec and only test disk was listed. The complete text of the description is as follows:
<quote> Partition scanner and disk recovery tool TestDisk checks the partition and boot sectors of your disks. It is very useful in recovering lost partitions. It works with : * DOS/Windows FAT12, FAT16 and FAT32 * NTFS ( Windows NT/2K/XP ) * Linux Ext2 and Ext3 * BeFS ( BeOS ) * BSD disklabel ( FreeBSD/OpenBSD/NetBSD ) * CramFS (Compressed File System) * HFS and HFS+, Hierarchical File System * JFS, IBM's Journaled File System * Linux Raid * Linux Swap (versions 1 and 2) * LVM and LVM2, Linux Logical Volume Manager * Netware NSS * ReiserFS 3.5 and 3.6 * Sun Solaris i386 disklabel * UFS and UFS2 (Sun/BSD/...) * XFS, SGI's Journaled File System . PhotoRec is file data recovery software designed to recover lost pictures from digital camera memory or even Hard Disks. It has been extended to search also for non audio/video headers. It searchs for * Sun/NeXT audio data (.au) * RIFF audio/video (.avi/.wav) * BMP bitmap (.bmp) * bzip2 compressed data (.bz2) * Source code written in C (.c) * Canon Raw picture (.crw) * Canon catalog (.ctg) * FAT subdirectory * Microsoft Office Document (.doc) * Nikon dsc (.dsc) * HTML page (.html) * JPEG picture (.jpg) * MOV video (.mov) * MP3 audio (MPEG ADTS, layer III, v1) (.mp3) * Moving Picture Experts Group video (.mpg) * Minolta Raw picture (.mrw) * Olympus Raw Format picture (.orf) * Portable Document Format (.pdf) * Perl script (.pl) * Portable Network Graphics (.png) * Raw Fujifilm picture (.raf) * Contax picture (.raw) * Rollei picture (.rdc) * Rich Text Format (.rtf) * Shell script (.sh) * Tar archive (.tar ) * Tag Image File Format (.tiff) * Microsoft ASF (.wma) * Sigma/Foveon X3 raw picture (.x3f) * zip archive (.zip) </quote>
Notice the reference to photorec in the second half which was what prompted my original post.
Cheers
Ian