Jamo Posted September 26, 2010 Share Posted September 26, 2010 Hi One of my friends had a computer and its OS was Windows. They decided to install linux, probably ubuntu on it. Well they didn't have any backups and now they lost all their pictures. So how to restore these pictures, or is it even possible - hdd was formatted in NTFS and now its in multiple partitions, and formatted to ext4. Im quite experienced with windows and ubuntu, but I never had to have recover files using ubuntu, and my friends are all newbies in the linux world. Quote Link to comment Share on other sites More sharing options...
BattZ Posted September 26, 2010 Share Posted September 26, 2010 I'm not sure if when you reformated to XT3 (or whatever you formated it as)it would write 0's to everything, I think it does though. Also, the fact that you over-wrote the hard drives with new info (ubuntu, packages, whatever is on the other partitions) I would say that the chance of getting pictures back would be quite small, but there are some programs that you could try to try and get them back. The names are slipping my mind atm, but I'm pretty sure they're on a usb stick around here, so once I find it I'll post them. Quote Link to comment Share on other sites More sharing options...
Sparda Posted September 26, 2010 Share Posted September 26, 2010 Your best bet would be to use a data carving tool and force it to assume NTFS file structure. http://sourceforge.net/projects/forensicfct/ Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted September 26, 2010 Share Posted September 26, 2010 Try out EASEUS Data Recovery Wizard Professional, seems to be pretty good to believe. http://www.easeus.com/product.htm Quote Link to comment Share on other sites More sharing options...
BattZ Posted September 26, 2010 Share Posted September 26, 2010 Sorry, but I couldn't find my USB stick with the programs on it. Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted September 26, 2010 Share Posted September 26, 2010 Get Helix 3 or Backtrack 4. Run the data carving tools: scalpel and foremost It is a VERY big long shot. I'd have to say the files are gone. With my experience in digital forensics, it doesn't look like you have a chance at getting any of the files back. Sorry. Quote Link to comment Share on other sites More sharing options...
digip Posted September 26, 2010 Share Posted September 26, 2010 (edited) Whatever they are doing, tell them to stop using the drive until they work out a plan to recover the files. The more you muck around in there, the more files will be lost and unrecoverable. I would mount it in another machine and do read only on the drive using tools either under windows or linux. I never tried recovering files from a linux filesystem, but there is the free program "File Recovery" from http://www.pcinspector.de/ and also "Handy Recovery" which does multiple file systems: http://www.handyrecovery.com/ Ive used both(free versions), but only on NTFS, so not sure how well they will work for your needs, but if they keep using the system, the more files they will lose and not be able to recover. Edited September 26, 2010 by digip Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted September 27, 2010 Share Posted September 27, 2010 Whatever they are doing, tell them to stop using the drive until they work out a plan to recover the files. The more you muck around in there, the more files will be lost and unrecoverable. I would mount it in another machine and do read only on the drive using tools either under windows or linux. I never tried recovering files from a linux filesystem, but there is the free program "File Recovery" from http://www.pcinspector.de/ and also "Handy Recovery" which does multiple file systems: http://www.handyrecovery.com/ Ive used both(free versions), but only on NTFS, so not sure how well they will work for your needs, but if they keep using the system, the more files they will lose and not be able to recover. I agree with dont mess with the drive. I had a guy come to me with a similar action. He wanted his files after running the system restore. Everything was gone except new/recent internet history he had done. Recovering files from EXT3 is hard to do. I had to give a presentation on it and it is a low success rate just because of how the EXT3 file system works. I haven't looked into EXT4 yet. He had NTFS and overwrite the file system with EXT3. Ubuntu will format the drive before use unless you chose the dual boot config. It would need to format it to get rid of NTFS file system and re-map for EXT3. Quote Link to comment Share on other sites More sharing options...
Jamo Posted September 27, 2010 Author Share Posted September 27, 2010 Hi Thanks for your answers. I also thought about using BT4, but when its my friends computer so, it might not be good to use questionable methods. I heard that they've done something and are now recovering 1000 pictures. Hopefully it works, but if not Ill try your ideas :) Quote Link to comment Share on other sites More sharing options...
digip Posted September 27, 2010 Share Posted September 27, 2010 Hi Thanks for your answers. I also thought about using BT4, but when its my friends computer so, it might not be good to use questionable methods. I heard that they've done something and are now recovering 1000 pictures. Hopefully it works, but if not Ill try your ideas :) Whats questionable about BackTrack? Its a legitimate tool used by thousands of people. BackTrack isn't a virus or something, its Linux with IT Tools for Security people, as well as those in law enforcement, the NSA, etc. If it can recover the files, why not give it a try? Quote Link to comment Share on other sites More sharing options...
Jamo Posted September 27, 2010 Author Share Posted September 27, 2010 hey've done something and are now recovering 1000 pictures. Hopefully it works, but if not Ill try your ideas Well BT is legimative, but cause Im unable to go to that laptop and they are not that good with computers, so I cant guide them how to use BT4 and those tools, maybe with Remote desktop connection, but it comes even harder. its easier to say: use this tool, its simple. Personally I like BackTrack a lot. Quote Link to comment Share on other sites More sharing options...
digip Posted September 27, 2010 Share Posted September 27, 2010 Im unable to go to that laptop and they are not that good with computers, so I cant guide them how to use BT4 Ah, I misunderstood you. Makes sense now. I thought maybe you thought it was some like bad thing to use or something. hehe :) Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted September 27, 2010 Share Posted September 27, 2010 If they did not dual boot the ubuntu install. I can almost guarantee all the images carved out are system images that were installed. Like for menus and default backgrounds ect. Quote Link to comment Share on other sites More sharing options...
Jamo Posted September 27, 2010 Author Share Posted September 27, 2010 If they did not dual boot the ubuntu install. I can almost guarantee all the images carved out are system images that were installed. Like for menus and default backgrounds ect. They didn't install it to dual boot with windows. Thats good point, that all images restored might be background images etc. It would be sad :(. But now they might start to take backups. Once again I notice how important it is to have backups :) Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted September 27, 2010 Share Posted September 27, 2010 They didn't install it to dual boot with windows. Thats good point, that all images restored might be background images etc. It would be sad :(. But now they might start to take backups. Once again I notice how important it is to have backups :) No only to have backups on DVD-R or other static media (Tape backup ect.). But to have a technical knowledge or someone to consult before saying "I want to try this and install this". Linux is not a Windows application, it is a Windows REPLACEMENT! :D Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.