Re: Tools to retrieve images from dead hard drive and/or deleted partitions
On Thursday 27 December 2012 21:17:56 berenger.morel@neutralite.org wrote:
> Ok, first, sorry to ask two questions at a time: dead drives and
> deleted partitions are different things, I know that.
>
> Let me explain "my" (they are, in fact, friend's problems) two problems
> (from different peoples).
>
> ===
> 0) the common part.
> By the past, I've did some researches about forensics (just as an
> amateur) and learned that you mostly work on copies of media from which
> you are trying to recover data.
> But the 2 HD from which I need to recover images (mostly jpeg, I guess.
> The users only said that's photos, ignoring, and does not willing to
> know, everything about format - but if that was not computer stuff, they
> would have know what they've used... - ) are bigger than all my current
> disks !
> One is 500Gb, the other is 1Tb, where mine are mostly a bunch of
> 40/80Gb + 1 or 2 of 250Gb.
>
> 1)
> I have a hard disk (1Tb, the bigger) which gave me many errors when I
> am trying to read it. It makes it very slow to even read, but I've been
> able to determine that it contains jpg images with a classic file
> browser. I did not managed to copy any data on a safer place...
> I am feared I will not even be able to retrieve one photo with my
> conventional hardware... but maybe some of you will have an idea?
>
> 2)
> I have an external hard disk which is readable without troubles. But
> partitions were probably destroyed, AFAIK. The user knows (as usual)
> nothing about what happened, so I do not even know if the partition
> system have been remade, or if it is simply a problem like "format c:".
> There are 2 partitions:
> _ 1: the smaller, some Gb only IIRC, which was of type FAT when I
> looked (or was it FAT32? Is it is very different?)
> _ 2: the bigger, and not a little, from my memory, it takes at least
> 80% of the whole disk, which is NTFS, I guess most data is there.
>
> ===
>
> So, do someone have faced one of those problems, and come to a
> solution?
>
> Of course, I've said to their owners that keeping data on only one HD
> is suicidal, I've said that they can probably pay big amounts of money
> to specialized establishments to have them back, and have kept their
> hardware for some months (without using them), as a sanction (well, I
> tried at some times to take an eye, but had other things to do).
>
> But, now, I'm in holidays, Christmas passed, and I'm thinking that
> could be an interesting gift to give back to people their photos of
> children and drunken nights, and I hope someone here could help me to do
> that for them :)
>
> I've big fears that the owner of (1) will have no other choice that
> asking to people with dedicated hardware, but I ask in case... for (2),
> I've more hopes, IF the user stopped the destructive process before the
> disk was fully erased, but I'll need the good tools.
I have heard good things of PhotoRec:
http://en.wikipedia.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec
But I have no personal experience of it. The advice is always to copy the
drive that needs rescuing to another drive, and work on the copy, not the
orginal. Again, I have not tried it.
Lisi
Reply to: