full-disclosure - Forensic help?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4324C0E2.5000602@science.org>
Date: Mon Sep 12 00:41:26 2005
From: jasonc at science.org (Jason Coombs)
Subject: Forensic help?

Red Leg wrote:
> I was wondering if anyone knows of a program/system that I can purchase, as
> a private individual, that will allow me to
...
> 3) Find any CONVENTIONALLY erased files?
> 
>  -- This would be either a Windows NTFS or FAT32 drive.

Use dcfldd to make the drive image.

http://sourceforge.net/projects/dcfldd

Then use Recover My Files and/or Mount Image Pro + your preferred 
deleted file recovery software. Mount Image Pro gives you the ability to 
mount raw forensic drive images produced using dd as well as EnCase 
forensic image file sets.

http://www.recovermyfiles.com/
http://www.getdata.com/
http://www.mountimage.com/

Regards,

Jason Coombs
jasonc@...ence.org