Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I am looking to do data recovery on disk drives and memory cards. For this I want a device or type of software which allows me to pull out the following data:

  • Allocated space
  • Unallocated space
  • Slack space
  • Bad blocks

I also need a software which aids in identifying types of content discovered in fully or partially discovered data.

I would like to have as much freedom when reading the disk drives as possible, such as retrying bad block reading or forcing certain operations on the disk. I am unsure if this requires a separate disk controller to be plugged onto the drives?

Does anyone have any recommendations?

share|improve this question
1  
This might be better suited on SuperUser as it doesn't really pertain to security in it's current form. – SteveS Sep 18 '12 at 6:35
Yeah, whilst the intent falls under forensics, it's basically a data recovery question. However, I don't think a migrate would work, since I'm sure someone's asked this before on SU. I'll flag for a mod and see what they say. – Polynomial Sep 18 '12 at 7:48
Definitively forensics work I have in mind here, however I see the possible migration issue. – Chris Andrè Dale Sep 18 '12 at 10:11
1  
Super User or IT Security, this question primarily appears to be a "product recommendation" request, which is generally off-topic on SE. – Iszi Oct 3 '12 at 20:09
@Karrax what Iszi said. You should know better ;) – AviD♦ Oct 3 '12 at 20:13
show 1 more comment

closed as not constructive by Iszi, AviD♦ Oct 3 '12 at 20:13

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

1 Answer

up vote 1 down vote accepted

Quick and dirty data recovery for Linux often involves

  • dd for disk imaging.
  • ddrescue if you find you have to deal with bad sectors. May not be optimized for flash memory (i.e. sd card/usb stick etc) though.
  • photorec for scanning raw disk images for various data formats (maybe copy the image and zero out the known files, so you only find deleted ones?).
  • testdisk looks for entire deleted partitions (same source as photorec)

"file" is occasionally useful, if you think you have a valid file but aren't sure what type of application to try reading it with. Much of the time I'm using it for some other purpose - though I guess my frequent file -s /dev/sda1 counts if you stretch it a bit.

There are definitely more specific, professional solutions though. I believe some software contains hashes of many known files. That would be useful for "needle in a haystack" problems - someone could have hidden files on a computer under the Windows directory, for example.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.