Sleuthkit – windows and linux file recovery



http://www.sleuthkit.org/ Sluethkit… is a collection of tools for forensic analysis of a system. Usually it’s something that would be done when you’ve had a suspected rootkit on the system and you boot to another operating system with sluethkit installed (maybe livecd/etc.) and want to try to analyze and hunt for traces of the rootkit. However you do have some similar procedures for forensic analysis that you would for the “I accidentally deleted a file” syndrome… For both situations you DON’T want to be running the live filesystem that’s affected.


This article…. http://www.ituprising.com/malawi/blog/jon/recovering_deleted_files_with_linux_and_sleuthkit describes using linux and sluethkit to recovered deleted files on windows or linux filesystems. First you should understand at a basic level how “deleting” a file works. If you think of the hard drive as a filing cabinet and each file is a “folder” with it’s label…. erasing a file through windows (putting it in the recycle bin) is the same as scribbling over the name of your manila folder with a note that says “you can throw this out”. It doesn’t actually delete the contents until you need the space for something else. It just sets aside the space as “no longer reserved”.

So, if you act quickly (power down the system and quit using it as soon as you realize you’ve deleted the file), you have a chance of recovering lost data files. (Truth be told, sometimes you can recover files deleted weeks in the past, it depends on how much “churn” there is on the disk. Your odds definitely decrease with time and usage of the system.)

Essentially the way this works to recover lost files is as follows…. take you’re disk that you accidentally lost data on, unplug from your system (power down first please.) Then, boot up another system with linux (either as a livecd/standalone operating system.) Then, image the hard drive with the “lost” data to a file on the other system. Once this is done power down and disconnect the original disk (with “lost” data.) (Don’t power it back up yet.) install sleuthkit and autopsy when you power up your linux system.

Then (as root) run autopsy and connect to it’s page with your web browser (http://localhost:9999/autopsy) start a new case and browse to the image file for the disk image… then choose the partition where your data should be. Next go to analyze -> file analysis…. you ought to be able to search and enter the filename, then follow through to “download” or save the file to disk (and by all means test that you can open.)

According to the tutorial they were able to recover a whole folder of files from a disk that “had been formatted and reinstalled with a new version of Windows XP.” Sounds like a pretty good data recovery option given the high price of many other data recovery services.

Oh… and here’s another reminder that if you’re getting rid of a hard drive, just erasing things…. doesn’t quite get the job done.

Related Posts

Blog Traffic Exchange Related Posts
  • X-Plane and linux I've mentioned X-Plane before - it's a flight simulator that strives to be as accurate flight modeling -wise as possible. Realism is one of their goals and it's also unique in that it's available for Mac/Windows and Linux (version 8 that is). (There is flightgear also, but X-Plane has still......
  • Kdirstat to track space hogs I'm putting this under the Windows tech support category because I've used this on a boot cd before to do the same for Windows as I'm about to describe for Linux. I need to clean up and organize my hard drive(s). But when it comes to actually deleting things you......
  • Windows to Linux migration tool With impeccable timing.... Desktop Linux is reporting that Resolvo systems has released their "MoveOver Enterprise" desktop migration tool to assist migrating from Windows to Linux in the Enterprise. The software automates the process through a wizard-driven interface and helps to make the transition from Microsoft Windows to Linux an easy......
Blog Traffic Exchange Related Websites
  • Proof You can only Push High Net Worth and High Income Individuals So Far! One of my favorite sites, The Tax Foundation, had a phenomenal couple posts about Maryland’s so-called Millionaire Tax.  The two main posts are, Maryland’s Millionaires Missing After Tax Hike and Maryland’s Lawmaker Proposes making Millionaires’ Tax Permanent.  Maryland, like many other States out there are hurting for cash, so......
  • Key New Features in SAINT 7.10 Key New Features in SAINT 7.10 SAINT Professional is now available on Mac OS X Lion (10.7). You can now fingerprint iPhones and iPads connected to your network. SAINT includes OS Fingerprinting during network discovery and/or vulnerability scanning. New OWASP Top 10 Web Application scanning policy including 12 new web......
  • REG file parser using the Boost Spirit Parser Framework I would like to thank the people who developed the following projects - they made the implementation of this project easier: I want to say a personal thank you to Silviu Simen for his article "INI file reader using the Spirit library". There was a project in which I took......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

No Responses to “Sleuthkit – windows and linux file recovery”

  1. computer repair Says:


    computer repair…

    Mac File Recovery is an easy to use Mac Data Recovery application that can solve each Mac File……


Switch to our mobile site