recover an entire drive that's been reinstalled..

[Sirbendy]

I've had a laptop back today, in shocking condition (TFT totally absent etc). Fired it up on my TFT, and it's been reinstalled totally..

 

Systeminfo gives me 7ish last night. I'm 98% sure of what I'm expecting..SO..what would/do you use to recover drives in situations like this? FileRescue Plus found a fair bit on clusterscan mode, but it won't do an entire disk rollback.

 

Currently running Active disk recovery too..not much going on there though.

 

Are there any decent linux distros for forensic data recovery?

 

Cheers all!

[OutToLunch]

If someone has wiped and reinstalled, any data which existed in the space where the new installation has landed is pretty much gone for good. You might get a few bits and pieces back from the free space on the drive but there's no way to do a whole disk rollback. If you want to try and have a poke around, have a look at the Backtrack distro.

[Sirbendy]

i'd settle for partial.

[OutToLunch]

Remote-Exploit.org - Supplying offensive security products to the world it is then

[User3204]

Go here File Recovery and Data Recovery Software. Hard Drive recovery utility

and pay for it.

 

It will allow you to recover most data from any disk, when writing to the disks it uses about 20bits to record a standard 8bit byte, so there is plenty of redundancy (actually that might be fore CDROM).

 

We installed it on a machine, and have found it to be pretty much invaluable, it's slightly annoying in that the licence version that we have only allows one install, and will only work for one user on that machine. There is a more expensive network license too.