On 19-Dec-08 15:51:12, Ian Thompson-Bell wrote:
Steve Fosdick wrote:
On 19/12/2008 11:37:01, Wayne Stallwood wrote:
On Fri, 2008-12-19 at 11:12 +0000, Mark Rogers wrote: Try Photorec http://www.cgsecurity.org/wiki/PhotoRec it is probably in your favourite distro's package repository (on ubuntu and debian it is in the testdisk package)
It works very well even if the partition information etc is lost as it just looks for recognisable file headers.
We had a talk at work a while back now from somebody from the police forensics team and the software they use to find things you shouldn't have or which may be useful evidence uses exactly this technique in case you have deleted the files or used a filesystem that the software cannot otherwise cope with.
It seems to be called testdisk under Ubuntu. Cheers Ian
Hmmm ... not sure if that's correct! Couldn't find PhotoRec in Debian, but did find testdisk, which is described as:
Partition scanner and disk recovery tool TestDisk checks the partition and boot sectors of your disks. It is very useful in recovering lost partitions.
No reference to having anything to do with searching for files!
See also: http://en.wikipedia.org/wiki/TestDisk Ted.
-------------------------------------------------------------------- E-Mail: (Ted Harding) Ted.Harding@manchester.ac.uk Fax-to-email: +44 (0)870 094 0861 Date: 19-Dec-08 Time: 16:08:26 ------------------------------ XFMail ------------------------------