I am looking to do data recovery on disk drives and memory cards. For this I want a device or type of software which allows me to pull out the following data:

  • Allocated space
  • Unallocated space
  • Slack space
  • Bad blocks

I also need a software which aids in identifying types of content discovered in fully or partially discovered data.

I would like to have as much freedom when reading the disk drives as possible, such as retrying bad block reading or forcing certain operations on the disk. I am unsure if this requires a separate disk controller to be plugged onto the drives?

Does anyone have any recommendations?

  • 1
    This might be better suited on SuperUser as it doesn't really pertain to security in it's current form. – Steve Sep 18 '12 at 6:35
  • Yeah, whilst the intent falls under forensics, it's basically a data recovery question. However, I don't think a migrate would work, since I'm sure someone's asked this before on SU. I'll flag for a mod and see what they say. – Polynomial Sep 18 '12 at 7:48
  • Definitively forensics work I have in mind here, however I see the possible migration issue. – Chris Dale Sep 18 '12 at 10:11
  • 1
    Super User or Information Security, this question primarily appears to be a "product recommendation" request, which is generally off-topic on SE. – Iszi Oct 3 '12 at 20:09
  • @Karrax what Iszi said. You should know better ;) – AviD Oct 3 '12 at 20:13

Quick and dirty data recovery for Linux often involves

  • dd for disk imaging.
  • ddrescue if you find you have to deal with bad sectors. May not be optimized for flash memory (i.e. sd card/usb stick etc) though.
  • photorec for scanning raw disk images for various data formats (maybe copy the image and zero out the known files, so you only find deleted ones?).
  • testdisk looks for entire deleted partitions (same source as photorec)

"file" is occasionally useful, if you think you have a valid file but aren't sure what type of application to try reading it with. Much of the time I'm using it for some other purpose - though I guess my frequent file -s /dev/sda1 counts if you stretch it a bit.

There are definitely more specific, professional solutions though. I believe some software contains hashes of many known files. That would be useful for "needle in a haystack" problems - someone could have hidden files on a computer under the Windows directory, for example.

Not the answer you're looking for? Browse other questions tagged or ask your own question.