I am looking to do data recovery on disk drives and memory cards. For this I want a device or type of software which allows me to pull out the following data:

  • Allocated space
  • Unallocated space
  • Slack space
  • Bad blocks

I also need a software which aids in identifying types of content discovered in fully or partially discovered data.

I would like to have as much freedom when reading the disk drives as possible, such as retrying bad block reading or forcing certain operations on the disk. I am unsure if this requires a separate disk controller to be plugged onto the drives?

Does anyone have any recommendations?

closed as not constructive by Iszi, AviD Oct 3 '12 at 20:13

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    This might be better suited on SuperUser as it doesn't really pertain to security in it's current form. – Steve Sep 18 '12 at 6:35
  • Yeah, whilst the intent falls under forensics, it's basically a data recovery question. However, I don't think a migrate would work, since I'm sure someone's asked this before on SU. I'll flag for a mod and see what they say. – Polynomial Sep 18 '12 at 7:48
  • Definitively forensics work I have in mind here, however I see the possible migration issue. – Chris Dale Sep 18 '12 at 10:11
  • 1
    Super User or Information Security, this question primarily appears to be a "product recommendation" request, which is generally off-topic on SE. – Iszi Oct 3 '12 at 20:09
  • @Karrax what Iszi said. You should know better ;) – AviD Oct 3 '12 at 20:13

Quick and dirty data recovery for Linux often involves

  • dd for disk imaging.
  • ddrescue if you find you have to deal with bad sectors. May not be optimized for flash memory (i.e. sd card/usb stick etc) though.
  • photorec for scanning raw disk images for various data formats (maybe copy the image and zero out the known files, so you only find deleted ones?).
  • testdisk looks for entire deleted partitions (same source as photorec)

"file" is occasionally useful, if you think you have a valid file but aren't sure what type of application to try reading it with. Much of the time I'm using it for some other purpose - though I guess my frequent file -s /dev/sda1 counts if you stretch it a bit.

There are definitely more specific, professional solutions though. I believe some software contains hashes of many known files. That would be useful for "needle in a haystack" problems - someone could have hidden files on a computer under the Windows directory, for example.

Not the answer you're looking for? Browse other questions tagged or ask your own question.