[brlug-general] forensics question: retrieving deleted data
jeff at think-solutions.com
Mon May 22 10:45:15 CDT 2006
Would you possibly share this program? I deal with a number of people that always seem to be losing images on camera cards (none CF mostly SD though).
From: Will Hill [mailto:williamhill2 at cox.net]
To: General at brlug.net
Sent: Mon, 22 May 2006 10:34:19 -0500
Subject: Re: [brlug-general] forensics question: retrieving deleted data
For fat delete and ruined tables, the answer is that the data is still there.
I've had some luck with a C program for finding images on corrupted CF cards.
You dd the whole CF to a file and set the program to work on that file. It
looks for the start and end characters of jpg images to copy out your image
files. The result is every photo that has not been overwritten is recovered.
The code is simple and I imagine the same thing can be done with all sorts of
files you might be interested in recovering.
On Sunday 21 May 2006 02:16 am, John Hebert wrote:
> 1) Does the Microsoft Windows 'format' command simply
> wipe out the partition table? Or does it do more than
> that? What exactly?
General mailing list
General at brlug.net
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the General