Data recovery

Data Recovery

"Data recovery is the process of salvaging data from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Often the data are being salvaged from storage media formats such as hard disk drives, storage tapes, CDs, DVDs, RAID, and other electronics. Recovery may be required due to physical damage to the storage device or logical damage to the file system that prevents it from being mounted by the host operating system. Although there is some confusion as to the term, data recovery can also be the process of retrieving and securing deleted information from a storage media for forensic purposes or spying." [1]

Data Carving

"Data Carving is a data recovery technique that allows for data with no file system allocation information to be extracted by identifying sectors and clusters belonging to the file. Data Carving usually searches through raw sectors looking for specific desired file signatures. The fact that there is no allocation information means that the investigator must specify a block size of data to carve out upon finding a matching file signature. This presents the challenge that the beginning of the file is still present and that there is (depending on how common the file signature is) a risk of many false hits. Also, data carving requires that the files recovered be located in sequential sectors (rather than fragmented) as there is no allocation information to point to fragmented file portions. This method can be time and resource intensive." [2]

PhotoRec

"PhotoRec is a data recovery software tool designed to recover lost files from digital camera memory, (CompactFlash, Memory Stick, SecureDigital, SmartMedia, Microdrive, MMC, USB Memory Drives etc.), Hard Disks and CD-ROMs. It recovers most common photo formats, including JPEG, and also recovers audio files including MP3, document formats such as Microsoft Office, PDF, and HTML, and archive formats including ZIP.

PhotoRec does not attempt to write to the damaged media you are about to recover from. Recovered files are instead written to the directory from where you are running PhotoRec or any other directory you choose. PhotoRec is shipped with TestDisk." (PhotoRec - Wikipedia)

See PhotoRec

TO READ

Howto: Recover lost files after you accidentally wipe your hard drive:

"I discovered TestDisk and PhotoRec and was able to use the latter to recover my lost files."

• TestDisk
• PhotoRec
• Linux.com :: How to recover lost files after you accidentally wipe your hard drive

• Using Darik's Boot and Nuke (DBAN) to totally wipe a drive
• Data Carving with PhotoRec to retrieve deleted files from formatted drives for forensics and disaster recovery

• PhotoRec
• Data Carving
• Recover deleted cookies or other files using Restoration
• Darik's Boot and Nuke

http://www.cgsecurity.org/wiki/PhotoRec http://www.forensicswiki.org/wiki/Carving http://www.cgsecurity.org/wiki/TestDisk_Download

http://dfrws.org/2006/challenge/ http://dftt.sourceforge.net/test11/index.html http://www.irongeek.com/i.php?page=videos/data-carving-with-photorec-to-retrieve-deleted-files-from-formatted-drives-for-forensics-and-disaster-recovery http://www.niiconsulting.com/checkmate/2006/12/data-carving-issues/ http://www.datalifter.com/products.htm