Re: [Ilugc] Re: Recover data from formatted ext3 partition

[Osamu Aoki <osamu@debian.org>]

Hi,

On Sat, May 30, 2009 at 01:18:05PM -0500, John Hasler wrote:
> Azhaguselvan writes:
> > Yes it has been formatted to ext3. So,does it mean that there is _no way_
> > of recovering my data :(
> 
> Some of your data may still be there.  You'll need to copy the partition to
> a file and examine it byte by byte with a hex editor or some such.  You
> may want to look at forensics software:
> 
> thumper/~ apt-cache search forensics
> autopsy - graphical interface to SleuthKit
> dcfldd - enhanced version of dd for forensics and security
> foremost - Forensics application to recover data
> rifiuti2 - A MS Windows recycle bin analysis tool
> scalpel - A Frugal, High Performance File Carver
> sleuthkit - Tools for forensics analysis
> tableau-parm - tableau write-blocking bridge query/command utility
> tct - collection of forensics related utilities

Intresting.

There were similar posting and  
"testdisk" - Utilities for partition scan and disk recovery. 
was suggested.

* reboot with rescue media
* make backup (scp/ftp/...) 
* then wok o recovery.





> Or just restore from your backups.
> -- 
> John Hasler
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org