Christopher Shanahan on 26 Oct 2005 17:43:58 -0000


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Recovery 2.5GB of deleted files


On Wednesday 26 October 2005 07:32, sean finney wrote:
> On Tue, Oct 25, 2005 at 03:40:36PM -0400, Eugene Smiley wrote:
> > > so... exactly what kind of data/how much data/how many files are we
> > > talking about here?
> >
> > They are JPGs from 500kB to 3MB in size in I-dont-know-how-many files
> > from 1.5 years of digital photography and 1 year of traditional
> > photography converted to digital. I'd love to get them back, and am
> > willing to put the work in, but it won't kill me if it's hopeless.
>
> aha, well jpegs aren't too hard to find, fortunately, since they mostly
> start with the same set of bits.  my knowledge of this subject in fact
> deals largely with also having accidentally purged some jpeg images
> on an ext3 partition (pictures of my mom, aww...).

foremost, foremost, foremost
Don't reinvent the wheel.

> [1] you may discover, as i did that tct/lazarus will only get you
>     the previously-discussed first 12 blocks of the file, so larger
>     images will require getting your hands dirty in any case.

As for TCT, you'll want TSK (The Sleuthkit), together with the Autopsy
Forensic Browser and foremost. Brian Carrier took TCT and continued to develop
it. It is now TSK.
  "The Sleuth Kit (TSK) is a collection of command line tools based on The
   Coroner's Toolkit (TCT). Autopsy is a graphical interface to the command
   line tools in TSK."

--
Christopher Shanahan

Attachment: pgpDNqck1xJUc.pgp
Description: PGP signature

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug