Recover data

[pelon07]

Hello guys,

There is a box that crashed, I have the DD and I need to pull up the information that was on the drive, I think the box was using windows.

I've heard that linux has an amazing software who can retrieve the information.

Do you guys have an Idea about this software? I've Easy Recovery, but maybe on linux there is a better option.

Thanks in adavance.

[unspawn]

There is a box that crashed I have the DD and I need to pull up the information that was on the drive

Crashed how? Details?

There's recovery tools that work right on the 'dd' image like 'testdisk' for partition recovery and "header/footer carvers" like 'photorec', 'scalpel', 'foremost' (or else Sleuthkit).

If you have no idea what the partitioning scheme of the disk is then running 'testdisk /list/debug /log' (or to some extent 'disktype') on the image provides an initial listing.

As it is preferable to get files of off the disk with naming intact so on encountering filesystem corruption you probably first want to assess damages by running the appropriate fsck/ntfsinfo commands in dry run mode before committing to fixing/fscking up :-]

To get to the partitions you can just losetup the whole disk then run 'kpartx -va' on the loopmount and find all partitions in /dev/mapper/. If corruption prohibits you from mounting partitions that way then you have the option to fix it first or fiddle with 'losetup' offsets if you know the layout.

Wrt tools no UI can ever replace knowledge so don't hold your breath for wizard-like or point-and-click GUI's ;-p