[BBLISA] Recover files from formatted HD

[Dean Anderson]

I just saw a book on this subject, "File System Forensic Analysis" at a 
Barnes and Noble. 

Of course, one might grumble more about Windows not "recognizing" a mac 
or linux disk, when it probably should.

		--Dean



On Thu, 15 May 2008, Edward Ned Harvey wrote:

> Nothing awesomely complex or unusual here.  A top executive has a mac at
> home, with all his photos and junk on it.  He brought in his external hard
> drive, and hooked it up to his dell at work.  Naiively assuming it would
> work.  Windows says "new drive found" and "drive not initialized. Initialize
> now?"  So he clicks yes.  Initializes and formats the drive.  All his files
> are gone, he calls me for help, I take his drive away to prevent further
> damage.  
> 
> Based on looking around, all the tools which recover formatted or deleted
> files seem to perform regardless of past or present filesystem.  Since they
> perform read-only at the block-level, looking for recognizable patterns
> "this looks like a jpg" and "this looks like a .doc file" etc.
> 
> I actually bought an $80 tool, used it, recovered some stuff, but certainly
> not 100%.  Just looking for other peoples' experience, to see if it's
> better, worse, or same as mine.
> 
> 
> 
> > -----Original Message-----
> > From: Ben Eisenbraun [mailto:bene at klatsch.org]
> > Sent: Thursday, May 15, 2008 9:06 PM
> > To: Edward Ned Harvey
> > Cc: 'Back Bay LISA'
> > Subject: Re: [BBLISA] Recover files from formatted HD
> > 
> > On Thu, May 15, 2008 at 08:55:26PM -0400, Edward Ned Harvey wrote:
> > > It was a mac HD [...] that was initialized & formatted NTFS.
> > 
> > Those two pieces of information together, while not impossible, are
> > definitely a bit unusual.  Can you give us any more info?  Were they
> > running
> > Windows on an Intel Mac?  Or were they using the FUSE NTFS driver under
> > OS
> > X?
> > 
> > I've used Restorer 2000 in the past to recover some data from a
> > formatted
> > NTFS filesystem.  It worked reasonably well.  You can download a demo
> > that
> > will run and give you an idea of what is recoverable.
> > 
> > http://www.restorer2000.com/
> > 
> > -ben
> > 
> > --
> > if stupidity got us into this mess; then why cant it get us out?
> >                                                    <will rogers>
> 
> _______________________________________________
> bblisa mailing list
> bblisa at bblisa.org
> http://www.bblisa.org/mailman/listinfo/bblisa
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000