Data recovery help request

[Kristian Hermansen]

Scott Ehrlich wrote:
> With all of this, is there a better way to try and recover the data?  My 
> next step is to use strings to try and recover whatever data I can.  Is 
> there any tool and/or method I can use to try and preserve the existing 
> data as though it came back from a data recovery shop, without having to 
> spend much money?  The drive is still pretty good, so I can always redo 
> the data retrieval.
> 
> The goal is data retrieval with little or no cost.
> 
> I'll be happy to consider Linux, Mac, and Windows options.

I have done this many times.  Recently, here at work, a database failed 
and I was able to recover the MSSQL database on an NTFS partition even 
after a format and re-installation of Windows :-)

Here's how to go about the art of recovery, or at the worst case, file 
carving:

FIRST DUMP THE DISK AND WORK ON THE COPY ONLY!!!  DO NOT TOUCH THE 
ORIGINAL DRIVE!!!  YOU CAN DO THIS SIMPLY WITH dd (off to another drive 
or remote file system)...

# dd if=/dev/hda of=/mnt/nfs/hda.dd

gpart: scans the drive for partition signatures and identifiers and can 
recover them.

foremost: a military-grade tool for file carving

magicrescue: let's you define custom file formats to carve out

others... google the two above to find more...
-- 
Kristian Hermansen

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.