<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Recovering Deleted Files</title>
	<atom:link href="http://blogs.gnome.org/shaunm/2008/03/03/recovering-deleted-files/feed/" rel="self" type="application/rss+xml" />
	<link>http://blogs.gnome.org/shaunm/2008/03/03/recovering-deleted-files/</link>
	<description>Fourteen hours to save the Earth</description>
	<lastBuildDate>Sat, 21 Nov 2009 04:45:44 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.6</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: H3g3m0n</title>
		<link>http://blogs.gnome.org/shaunm/2008/03/03/recovering-deleted-files/comment-page-1/#comment-43</link>
		<dc:creator>H3g3m0n</dc:creator>
		<pubDate>Tue, 04 Mar 2008 12:44:51 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.gnome.org/shaunm/2008/03/03/recovering-deleted-files/#comment-43</guid>
		<description>You probably want to try autopsy. Its fairly simple to use, just feed its web interface the location of the image file and you should get a nice list of all the deleted files. If you hadn&#039;t written extra data between the time you trashed the files and the time you did a dd then it should be there as normal USB storage devices use FAT which doesn&#039;t destroy anything important when you delete it.

Foremost is probably a bit to extreme if you didn&#039;t write extra data since it analyzes the files themselfs, this is a problem if your files had some fragmentation since you won&#039;t always get from start to end, this will of course often happen for large videos. Its more used for when the filesystems do delete the links themselfs thus trashing the links. Or when data has been written that might have deleted parts of files and such.

I carn&#039;t really comment on photorec, but according to the website it ignores the filesystem which is the same problem as Foremost.

Another alternative to autopsy is pyflag, but last time I tried it I couldn&#039;t get it working. You could get a copy of Helix (A live cd linux disto aimed at computer forensics with pyflag installed), just don&#039;t choose the option to load the whole thing into ram at boot as that stopped pyflag loading for me.

If there was data written then you might just be screwed :(</description>
		<content:encoded><![CDATA[<p>You probably want to try autopsy. Its fairly simple to use, just feed its web interface the location of the image file and you should get a nice list of all the deleted files. If you hadn&#8217;t written extra data between the time you trashed the files and the time you did a dd then it should be there as normal USB storage devices use FAT which doesn&#8217;t destroy anything important when you delete it.</p>
<p>Foremost is probably a bit to extreme if you didn&#8217;t write extra data since it analyzes the files themselfs, this is a problem if your files had some fragmentation since you won&#8217;t always get from start to end, this will of course often happen for large videos. Its more used for when the filesystems do delete the links themselfs thus trashing the links. Or when data has been written that might have deleted parts of files and such.</p>
<p>I carn&#8217;t really comment on photorec, but according to the website it ignores the filesystem which is the same problem as Foremost.</p>
<p>Another alternative to autopsy is pyflag, but last time I tried it I couldn&#8217;t get it working. You could get a copy of Helix (A live cd linux disto aimed at computer forensics with pyflag installed), just don&#8217;t choose the option to load the whole thing into ram at boot as that stopped pyflag loading for me.</p>
<p>If there was data written then you might just be screwed <img src='http://blogs.gnome.org/shaunm/wp-content/mu-plugins/tango-smilies/tango/face-sad.png' alt=':(' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tobias</title>
		<link>http://blogs.gnome.org/shaunm/2008/03/03/recovering-deleted-files/comment-page-1/#comment-35</link>
		<dc:creator>Tobias</dc:creator>
		<pubDate>Mon, 03 Mar 2008 18:49:37 +0000</pubDate>
		<guid isPermaLink="false">http://blogs.gnome.org/shaunm/2008/03/03/recovering-deleted-files/#comment-35</guid>
		<description>http://jimmac.musichall.cz/log/?p=414

In the past I had used WinHex for desperate cases. It is aware of Wine and offers to use the /dev/{s,d}da devices then.</description>
		<content:encoded><![CDATA[<p><a href="http://jimmac.musichall.cz/log/?p=414" rel="nofollow">http://jimmac.musichall.cz/log/?p=414</a></p>
<p>In the past I had used WinHex for desperate cases. It is aware of Wine and offers to use the /dev/{s,d}da devices then.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
