Comments on: Digital Forensics in Linux – Reclaiming Data Off a Failed Hard Drive.

By: UbuntuLinuxHelp

UbuntuLinuxHelp — Thu, 22 May 2008 20:07:35 +0000

@Christian – Oh… I know that noise well!!!! Yuck! ;)
Good luck!

By: Christian

Christian — Thu, 15 May 2008 19:18:39 +0000

Very interesting article. I actually have a 500 GB external hard drive that is making the dreaded clicking noise. I can still access most of the data, but I really need to make an image of it. I’ll be sure to see if I can use the tools you provided to create a working image of the drive :D

By: UbuntuLinuxHelp

UbuntuLinuxHelp — Wed, 12 Mar 2008 13:03:22 +0000

@left.crupps – You’re always welcome to write a related post for this blog (making sure there are credits and a link to you). ;)

As a matter of fact, anyone can become a contributor! Just send a message here: http://ubuntulinuxhelp.com/con.....tact/

For those interested in the apps mentioned…
PhotoRec: http://www.cgsecurity.org/wiki...../PhotoRec
RecoverJPG: http://www.rfc1149.net/devel/r.....ecoverjpeg

By: Ken

Ken — Wed, 12 Mar 2008 05:42:52 +0000

Very interesting post. I’m a beginner in the computer forensics world and enjoyed reading this.

By: lefty.crupps

lefty.crupps — Wed, 12 Mar 2008 01:01:26 +0000

Excellent article. I did something similar with an overwritten drive from a client, as well as another drive with a single bad sector. Both were Windows systems, the first with an XP reinstall over their precious data.

In both cases, I created an image (failed drive with either ‘dd_rescue’ or ddrescue’, and the overwritten drive with ‘dd’) and was able to recover the data. The overwritten drive, I tried FileRec for Windows (horrible), RecoverJPEG (Linux, decent), and PhotoRec (amazing).

I meant to write a blog post about each, but never did. I’ll make sure to bookmark your article, however! Thanks again!