[QCLUG] Recover of deleted files

[Noah Norris]

---------------------- multipart/alternative attachment
so i used helix to image the drive.. it worked well it copied every sector
of the drive
got the files recovered too ( imaged it so each test we could always go back
to the original drive ^^ )


On Jan 3, 2008 10:29 AM, Arron Lorenz <arronlorenz@gmail.com> wrote:

> Spinrite is more for total physical drive recovery not so much recovery of
> deleted files.
>
> On Jan 3, 2008 10:21 AM, Baldy <baldy@mchsi.com> wrote:
>
> > Noah Norris wrote:
> > > Anyone good at recovering deleted files ?
> > >
> > > i got a person that accidentally deleted there mailbox from outlook
> > > and immediately killed there system (powered off)
> > > and wants to recover the files. files are on an NTFS file system drive
> >
> > > thats 250 GB
> > >
> > > (i believe the exact way was the user draged there mailbox to the
> > > recycle bin and started to empty
> > > it and then stopped the process half way once they noticed what was
> > > going on and powered off )
> > >
> > > anyone have any ideas involving linux and even  paid for software that
> > > runs in linux or windows
> > >
> > > I have been messing with some forensic distros lately i was maybe
> > > hoping some tools from those could help.
> > > but my knowledge with them is not the best anyone point me in the
> > > right direction . ive been messing with helix
> > > but most of the distro's seem a little outdated.
> > The best one on the market is Spin-Rite by Steve Gibson
> > http://www.grc.com/sr/spinrite.htm
> >
> > --
> > http://www.baldysparadox.com
> > ICQ #899207
> > Skype Riverhack
> > Open 24 hours a day for your browsing ease!
> >
> > _______________________________________________
> > QCLUG mailing list
> > QCLUG@qclug.org
> > http://qclug.org/mailman/listinfo/qclug
> >
>
>
>
> --
> From:
> Arron James Lorenz
> Reach Global Networks LLC
> MobileTek Inc
> 563-579-7046

---------------------- multipart/alternative attachment
An HTML attachment was scrubbed...
URL: http://qclug.org/pipermail/qclug/attachments/84a6b4ad/attachment.htm

---------------------- multipart/alternative attachment--