[brlug-general] forensics question: retrieving deleted data

[Jeffrey Lee]

Would you possibly share this program? I deal with a number of people that always seem to be losing images on camera cards (none CF mostly SD though).

Thanks,
Jeffrey Lee

  _____  

From: Will Hill [mailto:williamhill2 at cox.net]
To: General at brlug.net
Sent: Mon, 22 May 2006 10:34:19 -0500
Subject: Re: [brlug-general] forensics question: retrieving deleted data

For fat delete and ruined tables, the answer is that the data is still there.

I've had some luck with a C program for finding images on corrupted CF cards.  
You dd the whole CF to a file and set the program to work on that file.  It 
looks for the start and end characters of jpg images to copy out your image 
files. The result is every photo that has not been overwritten is recovered.  

The code is simple and I imagine the same thing can be done with all sorts of 
files you might be interested in recovering.

On Sunday 21 May 2006 02:16 am, John Hebert wrote:

> Questions:
> 1) Does the Microsoft Windows 'format' command simply
> wipe out the partition table? Or does it do more than
> that? What exactly?

_______________________________________________
General mailing list
General at brlug.net
http://brlug.net/mailman/listinfo/general_brlug.net
  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://brlug.net/pipermail/general_brlug.net/attachments/20060522/82769a2c/attachment.htm