| Christopher Shanahan on 26 Oct 2005 17:43:58 -0000 |
|
On Wednesday 26 October 2005 07:32, sean finney wrote: > On Tue, Oct 25, 2005 at 03:40:36PM -0400, Eugene Smiley wrote: > > > so... exactly what kind of data/how much data/how many files are we > > > talking about here? > > > > They are JPGs from 500kB to 3MB in size in I-dont-know-how-many files > > from 1.5 years of digital photography and 1 year of traditional > > photography converted to digital. I'd love to get them back, and am > > willing to put the work in, but it won't kill me if it's hopeless. > > aha, well jpegs aren't too hard to find, fortunately, since they mostly > start with the same set of bits. my knowledge of this subject in fact > deals largely with also having accidentally purged some jpeg images > on an ext3 partition (pictures of my mom, aww...). foremost, foremost, foremost Don't reinvent the wheel. > [1] you may discover, as i did that tct/lazarus will only get you > the previously-discussed first 12 blocks of the file, so larger > images will require getting your hands dirty in any case. As for TCT, you'll want TSK (The Sleuthkit), together with the Autopsy Forensic Browser and foremost. Brian Carrier took TCT and continued to develop it. It is now TSK. "The Sleuth Kit (TSK) is a collection of command line tools based on The Coroner's Toolkit (TCT). Autopsy is a graphical interface to the command line tools in TSK." -- Christopher Shanahan Attachment:
pgpDNqck1xJUc.pgp ___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
|
|