sleuthkit

Data recovery blog

I came across a couple of pretty good sites detailing some of the tools and processes I use for data recovery.

http://wiki.lunarsoft.net/wiki/Data_Recovery

http://shsc.info/DataRecovery

Basically this wiki steps you through recovering data via a bootable Linux CD/USB. This wiki recommends RIPLinux, though I personally use SystemRescueCd which is just another bootable Linux distribution designed for data and system recovery.

The utilities which are important are ddrescue, badblocks, and smartctl.  I also use foremost, autopsy, ntfs-3g, ssh/scp, rsync, samba, 7z when doing data recovery work. 

Essentially the first task is to see just what kind of shape the drive is in.  For this we use smartctl to query the drive's S.M.A.R.T. statistics.  These numbers will tell us just how many errors the drive is producing, and can give us an estimate of how much time we have to work with. 

a "smartctl --all /dev/<device>" will print the stats from that particular drive. 

For example, on one of my systems I run the following:

Syndicate content