sorted by: recent | see : popular

Content Tagged with recover + files

NTFS Data Recovery software easily provides deleted, formatted ntfs data from NTFS partition of windows os. NTFS Data Recovery utility easily provides recovery from NTFS & NTFS5 file system.

Recover Data Labs provide complete solution of data recovery software. Software successfully recover deleted data and restore lost data from Windows, Linux, Novell & Mac OS based hard disk drive. Get everything back using best data recovery software.

Deleted File Recovery to recover, retrieve and restore deleted file from Windows hard drive. Advance file undelete tool to get back deleted files easily using Recover Data for Deleted File Recovery Software. Software supports to recover deleted files from deleted or formatted FAT-NTFS hard drive.

Ok I accidentally deleted my /etc/network/interfaces file and didnt have my access point connected to a pc, its just wireless now, so what I did to recover the file was this, please note if you delete the file shutdown your pc immediately or unmount your drive as fast as possible to avoid overwriting the deleted data. This method can be used to find unencrypted passwords and interesting information as well. This works best from a livecd/unmounted filesystem:



grep --binary-files=text -300 "Unique String in Text file" /dev/hda1 > output.txt

The -300 option tells grep to report the 300 lines before the string you choose

Basically this will take quite a while depending on the size of your hard drive and may output a ton of irrelevent information to the output.txt file, you may want to edit the -300 line variable and do man grep to see further usage options.

This method worked for me only because I shutdown my pc immediately and booted into my Hardy Livecd and the file was still available, I just copied/pasted the relevant output to my interfaces file.

Alternatively you can use the strings command to dump all the text on a partition then grep the strings output for the relevent output, Here is an example:

strings /dev/hda1 > bigtxtfile

grep -i "information" bigtxtfile > grepoutputfile

I ran into another program that is utterly Amazing, actually quite scary, I was able to recover photo's deleted from months ago, even after reading/writing the drive. So now I will need to find a tool to wipe what was deleted lol.. Here is some info..

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.

Originally developed by the United States Air Force Office of Special Investigations and The Center for Information Systems Security Studies and Research , foremost has been opened to the general public

source code http://foremost.sourceforge.net/

Grab foremost:

sudo apt-get install foremost

Have Foremost audit your drive for recoverable files:

sudo foremost -w -i /dev/hda -o /recovery/foremost

Have foremost recover jpg files:

sudo foremost -t jpg -i /dev/hda -o /recovery/foremost

If you have additional suggestions or methods to restore files please comment and share your knowledge