±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 7 Overall: 36105
New Yesterday: 9 Visitors: 155

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Recover data from formatted drive/floppy

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

hezry79
Newbie
 

Recover data from formatted drive/floppy

Post Posted: Jul 22, 05 20:30

I am self learner about Computer Forensic and I use trial tools such as EnCase and X-Ways to recover lost files. I would like to ask some question to you guyz out there.

If the file was deleted from the hard drive, the application can recover it[ i succesfully done this]. But how about if the hard drive has been formatted? Can it be recovered?. I try to format a floppy disk, and implement those EnCase or X-Ways tools to recover the previous file in that floopy. But I fail to get it back.

Is that true that if the drive is formatted, we can't get any data back?

Thank you  
 
  

fatrabbit
Senior Member
 

Re: Recover data from formatted drive/floppy

Post Posted: Jul 23, 05 00:15

Recovering data deleted by formatting is possible with the exception of low level formats. While general formatting and quick formatting deletes only the data information and leaves the actual file on the HDD, low level formatting deletes all data areas and causes the same result as an overwrite.
_________________
fatrabbit 
 
  

hezry79
Newbie
 

Re: Recover data from formatted drive/floppy

Post Posted: Jul 23, 05 07:05

But why when I do a test on my floppy for example, I save one word file and delete it from the floppy. After that I do general format on that floppy. Then I use encase/xways tools to get the data back from the floppy but I can't even see any file appear... why is it?
_________________
 
 
  

andy1500mac
Senior Member
 

Re: Recover data from formatted drive/floppy

Post Posted: Jul 23, 05 08:37

You won't see the file in a hierarchical (windows explorer) type layout as the format will have gotten rid of the file structure.

Search for the header ÐÏ.ࡱ.á (ms office header for .docs, .xls etc...) in free space or do a keyword search in the free space for a word or phrase you know to be in the document. You should be able to find it.

Andrew-  
 
  

hezry79
Newbie
 

Re: Recover data from formatted drive/floppy

Post Posted: Jul 23, 05 08:46

I will try it now
_________________
 
 
  

hezry79
Newbie
 

Re: Recover data from formatted drive/floppy

Post Posted: Jul 23, 05 09:11

ok success. i create a text file name test and write something inside it. and format the floppy disk. i use encase to recover it and i found it. this is similar to any document such as word or ect...

but how about picture such as jpg, gif, bmp?....how to track it and save it back to it own format?

thanks for guidance
_________________
 
 
  

andy1500mac
Senior Member
 

Re: Recover data from formatted drive/floppy

Post Posted: Jul 23, 05 10:23

It is the same thing regardless of the type of file although some are more difficult that others. You can test using the same logic. Save a .jpg to the floppy and format it. If you go back into the free space area and look for the header ÿØÿà you should locate the file.

It is possible to manually extract them but most of the forensic software packages have built in features that search for file headers and then recover them for you if found.

If you want some more info on file signatures take a look at www.garykessler.net/li..._sigs.html

Hope this helps.

Andrew-  
 

Page 1 of 3
Page 1, 2, 3  Next