From preludelinux@gmail.com Thu Jan 3 15:11:58 2008 From: preludelinux@gmail.com (Noah Norris) Date: Thu, 3 Jan 2008 09:11:58 -0600 Subject: [QCLUG] Recover of deleted files Message-ID: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> ---------------------- multipart/alternative attachment Anyone good at recovering deleted files ? i got a person that accidentally deleted there mailbox from outlook and immediately killed there system (powered off) and wants to recover the files. files are on an NTFS file system drive thats 250 GB (i believe the exact way was the user draged there mailbox to the recycle bin and started to empty it and then stopped the process half way once they noticed what was going on and powered off ) anyone have any ideas involving linux and even paid for software that runs in linux or windows I have been messing with some forensic distros lately i was maybe hoping some tools from those could help. but my knowledge with them is not the best anyone point me in the right direction . ive been messing with helix but most of the distro's seem a little outdated. ---------------------- multipart/alternative attachment An HTML attachment was scrubbed... URL: http://qclug.org/pipermail/qclug/attachments/73ba43e2/attachment.htm ---------------------- multipart/alternative attachment-- From fatpuppystew@gmail.com Thu Jan 3 15:51:14 2008 From: fatpuppystew@gmail.com (Mike Robinson) Date: Thu, 03 Jan 2008 09:51:14 -0600 Subject: [QCLUG] Recover of deleted files In-Reply-To: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> References: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> Message-ID: <1199375474.3178.5.camel@home7> there is Encase for windows, but you can only get a copy of that if you work for law enforcement. Helix is probably your best bet - check http://www.e-fense.com/helix/ As they charge for training, I'd start with their forum first for info on recovering deleted files http://www.e-fense.com/helix/forum/index.php If they are willing to pay, http://www.drivesavers.com has a great reputation, but they can be pricy good luck - pst files can be tricky On Thu, 2008-01-03 at 09:11 -0600, Noah Norris wrote: > > but most of the distro's seem a little outdated. From preludelinux@gmail.com Thu Jan 3 16:20:54 2008 From: preludelinux@gmail.com (Noah Norris) Date: Thu, 3 Jan 2008 10:20:54 -0600 Subject: [QCLUG] Recover of deleted files In-Reply-To: <1199375474.3178.5.camel@home7> References: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> <1199375474.3178.5.camel@home7> Message-ID: <65dc1580801030820k4923458ckc6089a6cae2a8418@mail.gmail.com> ---------------------- multipart/alternative attachment thanks for the info yeah ive been looking into Helix On Jan 3, 2008 9:51 AM, Mike Robinson wrote: > there is Encase for windows, but you can only get a copy of that if you > work for law enforcement. Helix is probably your best bet - check > > http://www.e-fense.com/helix/ > > As they charge for training, I'd start with their forum first for info > on recovering deleted files > http://www.e-fense.com/helix/forum/index.php > > > If they are willing to pay, http://www.drivesavers.com has a great > reputation, but they can be pricy > > good luck - pst files can be tricky > > On Thu, 2008-01-03 at 09:11 -0600, Noah Norris wrote: > > > > but most of the distro's seem a little outdated. > > _______________________________________________ > QCLUG mailing list > QCLUG@qclug.org > http://qclug.org/mailman/listinfo/qclug > ---------------------- multipart/alternative attachment An HTML attachment was scrubbed... URL: http://qclug.org/pipermail/qclug/attachments/91029b35/attachment.htm ---------------------- multipart/alternative attachment-- From baldy@mchsi.com Thu Jan 3 16:21:59 2008 From: baldy@mchsi.com (Baldy) Date: Thu, 03 Jan 2008 10:21:59 -0600 Subject: [QCLUG] Recover of deleted files In-Reply-To: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> References: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> Message-ID: <477D0BA7.4090902@mchsi.com> Noah Norris wrote: > Anyone good at recovering deleted files ? > > i got a person that accidentally deleted there mailbox from outlook > and immediately killed there system (powered off) > and wants to recover the files. files are on an NTFS file system drive > thats 250 GB > > (i believe the exact way was the user draged there mailbox to the > recycle bin and started to empty > it and then stopped the process half way once they noticed what was > going on and powered off ) > > anyone have any ideas involving linux and even paid for software that > runs in linux or windows > > I have been messing with some forensic distros lately i was maybe > hoping some tools from those could help. > but my knowledge with them is not the best anyone point me in the > right direction . ive been messing with helix > but most of the distro's seem a little outdated. The best one on the market is Spin-Rite by Steve Gibson http://www.grc.com/sr/spinrite.htm -- http://www.baldysparadox.com ICQ #899207 Skype Riverhack Open 24 hours a day for your browsing ease! From arronlorenz@gmail.com Thu Jan 3 16:29:12 2008 From: arronlorenz@gmail.com (Arron Lorenz) Date: Thu, 3 Jan 2008 10:29:12 -0600 Subject: [QCLUG] Recover of deleted files In-Reply-To: <477D0BA7.4090902@mchsi.com> References: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> <477D0BA7.4090902@mchsi.com> Message-ID: <30cf66b30801030829oca73aeq6f06726be7686f97@mail.gmail.com> ---------------------- multipart/alternative attachment Spinrite is more for total physical drive recovery not so much recovery of deleted files. On Jan 3, 2008 10:21 AM, Baldy wrote: > Noah Norris wrote: > > Anyone good at recovering deleted files ? > > > > i got a person that accidentally deleted there mailbox from outlook > > and immediately killed there system (powered off) > > and wants to recover the files. files are on an NTFS file system drive > > thats 250 GB > > > > (i believe the exact way was the user draged there mailbox to the > > recycle bin and started to empty > > it and then stopped the process half way once they noticed what was > > going on and powered off ) > > > > anyone have any ideas involving linux and even paid for software that > > runs in linux or windows > > > > I have been messing with some forensic distros lately i was maybe > > hoping some tools from those could help. > > but my knowledge with them is not the best anyone point me in the > > right direction . ive been messing with helix > > but most of the distro's seem a little outdated. > The best one on the market is Spin-Rite by Steve Gibson > http://www.grc.com/sr/spinrite.htm > > -- > http://www.baldysparadox.com > ICQ #899207 > Skype Riverhack > Open 24 hours a day for your browsing ease! > > _______________________________________________ > QCLUG mailing list > QCLUG@qclug.org > http://qclug.org/mailman/listinfo/qclug > -- From: Arron James Lorenz Reach Global Networks LLC MobileTek Inc 563-579-7046 ---------------------- multipart/alternative attachment An HTML attachment was scrubbed... URL: http://qclug.org/pipermail/qclug/attachments/35af037f/attachment.htm ---------------------- multipart/alternative attachment-- From preludelinux@gmail.com Thu Jan 3 16:31:11 2008 From: preludelinux@gmail.com (Noah Norris) Date: Thu, 3 Jan 2008 10:31:11 -0600 Subject: [QCLUG] Recover of deleted files In-Reply-To: <477D0BA7.4090902@mchsi.com> References: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> <477D0BA7.4090902@mchsi.com> Message-ID: <65dc1580801030831q6715895aj1ef34a19ebf52363@mail.gmail.com> ---------------------- multipart/alternative attachment thought spin rite was for damaged drives it works on deleted files too ? its important emails , the system has not been rebooted ( it was powered off directly ) im gona image the drive first then try a restore ( worth an easy try ) On Jan 3, 2008 10:21 AM, Baldy wrote: > Noah Norris wrote: > > Anyone good at recovering deleted files ? > > > > i got a person that accidentally deleted there mailbox from outlook > > and immediately killed there system (powered off) > > and wants to recover the files. files are on an NTFS file system drive > > thats 250 GB > > > > (i believe the exact way was the user draged there mailbox to the > > recycle bin and started to empty > > it and then stopped the process half way once they noticed what was > > going on and powered off ) > > > > anyone have any ideas involving linux and even paid for software that > > runs in linux or windows > > > > I have been messing with some forensic distros lately i was maybe > > hoping some tools from those could help. > > but my knowledge with them is not the best anyone point me in the > > right direction . ive been messing with helix > > but most of the distro's seem a little outdated. > The best one on the market is Spin-Rite by Steve Gibson > http://www.grc.com/sr/spinrite.htm > > -- > http://www.baldysparadox.com > ICQ #899207 > Skype Riverhack > Open 24 hours a day for your browsing ease! > > _______________________________________________ > QCLUG mailing list > QCLUG@qclug.org > http://qclug.org/mailman/listinfo/qclug > ---------------------- multipart/alternative attachment An HTML attachment was scrubbed... URL: http://qclug.org/pipermail/qclug/attachments/e41b8bd6/attachment.htm ---------------------- multipart/alternative attachment-- From volunteer@revealed.net Thu Jan 3 17:28:28 2008 From: volunteer@revealed.net (Jim Hall) Date: Thu, 03 Jan 2008 11:28:28 -0600 Subject: [QCLUG] January 2008 meeting Message-ID: <477D1B3C.8090403@revealed.net> Since this is a bad time of year to set something new up, we will go with what works. This is an occasional situation. We're going to try the Myth demo again. We'll be at my church, I've already reserved the room (see below). 1) We have a projector and screen in the room, so if the promised monitor doesn't make it we're covered. This will be the monitor. 2) I have a borrowed wireless AP (11b). Works if someone has a patch cable in their laptop bag. For experimentation - don't laugh, best I could do. If you want 11g, bring one. 3) There are pop, snack, and hot chocolate machines downstairs. However, be warned! <> Position yourself in the room accordingly. Spillage will be punished by 50 lashes with a virtual wet noodle. Time info. Tuesday, January 8, 2008 6:30 PM to 8:00 PM Location info. First Presbyterian Church 1702 Iowa St. Davenport, IA I've checked Google Maps. Type in the search box "1702 iowa st davenport, ia". That should give you the street layout. If you need more detail of the church and parking lot, click on the "Satellite" tab in the upper right corner of the map. Zoom in to your heart's content Parking is off Iowa St. on the North side of the bldg. The entrance is on Iowa St. just South of the lot (double red doors). Enter bldg. (you will have to open door yourself - no auto open) Go down short flight of stairs. Go straight ahead. Pass water cooler to elevator (on your left). Push the "Up" call button. Get in elevator when the door opens. Push button labeled "3". When get to 3rd floor and door opens, get out of elevator. Turn left, go to open door on your right (look for orange cones on floor). Success. You have arrived. I hope these directions are complete enough so nobody gets lost. If you do, ask people you see until you find someone who knows enough to direct you. NOTE! I would like to show our guest a 3D desktop and Xen and Wine, if anybody has those running. See you there, Jim PS: For those who didn't get it, the directions are supposed to be humor, though complete and accurate. From preludelinux@gmail.com Thu Jan 3 16:46:20 2008 From: preludelinux@gmail.com (Noah Norris) Date: Thu, 3 Jan 2008 10:46:20 -0600 Subject: [QCLUG] January 2008 meeting In-Reply-To: <477D1B3C.8090403@revealed.net> References: <477D1B3C.8090403@revealed.net> Message-ID: <65dc1580801030846y3e183671lfd04f5ceaaec025c@mail.gmail.com> ---------------------- multipart/alternative attachment I can do 3d desktop, vmware-server , and some games On Jan 3, 2008 11:28 AM, Jim Hall wrote: > Since this is a bad time of year to set something new up, we will go > with what works. This is an occasional situation. > > We're going to try the Myth demo again. We'll be at my church, I've > already reserved the room (see below). > > 1) We have a projector and screen in the room, so if the promised > monitor doesn't make it we're covered. This will be the monitor. > 2) I have a borrowed wireless AP (11b). Works if someone has a patch > cable in their laptop bag. For experimentation - don't laugh, best I > could do. If you want 11g, bring one. > 3) There are pop, snack, and hot chocolate machines downstairs. > However, be warned! < COMPUTERS!!>> Position yourself in the room accordingly. Spillage will > be punished by 50 lashes with a virtual wet noodle. > > Time info. > Tuesday, January 8, 2008 > 6:30 PM to 8:00 PM > > Location info. > First Presbyterian Church > 1702 Iowa St. > Davenport, IA > > I've checked Google Maps. Type in the search box "1702 iowa st > davenport, ia". That should give you the street layout. If you need more > detail of the church and parking lot, click on the "Satellite" tab in > the upper right corner of the map. Zoom in to your heart's content > > Parking is off Iowa St. on the North side of the bldg. The entrance is > on Iowa St. just South of the lot (double red doors). > Enter bldg. (you will have to open door yourself - no auto open) > Go down short flight of stairs. Go straight ahead. > Pass water cooler to elevator (on your left). > Push the "Up" call button. Get in elevator when the door opens. Push > button labeled "3". > When get to 3rd floor and door opens, get out of elevator. > Turn left, go to open door on your right (look for orange cones on floor). > Success. You have arrived. > > I hope these directions are complete enough so nobody gets lost. If you > do, ask people you see until you find someone who knows enough to direct > you. > > NOTE! I would like to show our guest a 3D desktop and Xen and Wine, if > anybody has those running. > > > See you there, > Jim > > PS: For those who didn't get it, the directions are supposed to be > humor, though complete and accurate. > > _______________________________________________ > QCLUG mailing list > QCLUG@qclug.org > http://qclug.org/mailman/listinfo/qclug > ---------------------- multipart/alternative attachment An HTML attachment was scrubbed... URL: http://qclug.org/pipermail/qclug/attachments/983f1c0f/attachment.htm ---------------------- multipart/alternative attachment-- From volunteer@revealed.net Tue Jan 8 01:49:35 2008 From: volunteer@revealed.net (Jim Hall) Date: Mon, 07 Jan 2008 19:49:35 -0600 Subject: [QCLUG] Meeting reminder Message-ID: <4782D6AF.9000405@revealed.net> January meeting is tomorrow night. Demo on Myth TV. Try to come. For info see previous post. Jim From preludelinux@gmail.com Tue Jan 8 01:30:30 2008 From: preludelinux@gmail.com (Noah Norris) Date: Mon, 7 Jan 2008 19:30:30 -0600 Subject: [QCLUG] Recover of deleted files In-Reply-To: <30cf66b30801030829oca73aeq6f06726be7686f97@mail.gmail.com> References: <65dc1580801030711i5604f94drd1fe90cc178dbce3@mail.gmail.com> <477D0BA7.4090902@mchsi.com> <30cf66b30801030829oca73aeq6f06726be7686f97@mail.gmail.com> Message-ID: <65dc1580801071730o5c909c9di21166c5823135b16@mail.gmail.com> ---------------------- multipart/alternative attachment so i used helix to image the drive.. it worked well it copied every sector of the drive got the files recovered too ( imaged it so each test we could always go back to the original drive ^^ ) On Jan 3, 2008 10:29 AM, Arron Lorenz wrote: > Spinrite is more for total physical drive recovery not so much recovery of > deleted files. > > On Jan 3, 2008 10:21 AM, Baldy wrote: > > > Noah Norris wrote: > > > Anyone good at recovering deleted files ? > > > > > > i got a person that accidentally deleted there mailbox from outlook > > > and immediately killed there system (powered off) > > > and wants to recover the files. files are on an NTFS file system drive > > > > > thats 250 GB > > > > > > (i believe the exact way was the user draged there mailbox to the > > > recycle bin and started to empty > > > it and then stopped the process half way once they noticed what was > > > going on and powered off ) > > > > > > anyone have any ideas involving linux and even paid for software that > > > runs in linux or windows > > > > > > I have been messing with some forensic distros lately i was maybe > > > hoping some tools from those could help. > > > but my knowledge with them is not the best anyone point me in the > > > right direction . ive been messing with helix > > > but most of the distro's seem a little outdated. > > The best one on the market is Spin-Rite by Steve Gibson > > http://www.grc.com/sr/spinrite.htm > > > > -- > > http://www.baldysparadox.com > > ICQ #899207 > > Skype Riverhack > > Open 24 hours a day for your browsing ease! > > > > _______________________________________________ > > QCLUG mailing list > > QCLUG@qclug.org > > http://qclug.org/mailman/listinfo/qclug > > > > > > -- > From: > Arron James Lorenz > Reach Global Networks LLC > MobileTek Inc > 563-579-7046 ---------------------- multipart/alternative attachment An HTML attachment was scrubbed... URL: http://qclug.org/pipermail/qclug/attachments/84a6b4ad/attachment.htm ---------------------- multipart/alternative attachment-- From roadkill-ml@darktraveler.com Wed Jan 30 23:34:41 2008 From: roadkill-ml@darktraveler.com (Roadkill the Avatar of Misfortune) Date: Wed, 30 Jan 2008 17:34:41 -0600 Subject: [QCLUG] Server downtime Message-ID: <200801301734.41476.roadkill-ml@darktraveler.com> Tomorrow 01/31/2008 after 6pm the server will come down. Everything should be back online before the end of the day on Friday. Sorry for any I couldn't give more warning on this, rk