[clug] PC Forensics / Fun

[tridge at samba.org]

Matt,

 > So, has anyone had any experience playing with linux (or similar) and 
 > recovering/analysing HDD's that have been 'wiped'?
 > Can anyone recommend/share experiences with programs (be it good or bad 
 > results)?

I can highly recommend 'photorec'. It is GPLd, and runs on both
Windows and Linux. Despite the name, it recovers lots of file types,
not just images.

I used it last week to recover a relatives disk. They had
re-partitioned and reinstalled Windows XP on a machine, then realised
they had lost all their files by doing so. Photorec recovered nearly
everything.

It only works if the data is still there of course, so most useful
when a filesystem has been formatted or is just so corrupt that normal
recovery tools are useless. 

Cheers, Tridge