±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35755
New Yesterday: 1 Visitors: 95

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Quickbooks .qbw file recovery

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

Andy
Senior Member
 

Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 01:14

I am dealing with a case at present whereby I need to recover .qbw files (quickbooks). The drive (an exteral ethernet NAS) has been formatted as a Linux partition, and has no folder structure (other than an empty hardlinks directory on the root). The quickbooks software is for Windows so I'm a little puzzled at the Linux partition. I do not know any history of the drive, other than - a 'data recovery' has been attempted and this is possibly responsible for the Linux partition. Or the Linux OS is a cut down version used to run the NAS.

Anyone ideas for recovery of .qbw files, which will now possibly be in the unallocated? I could do with the header and footer..... of some extraction/repair tool. Or if anyone knows of a script/EnScript I'd be grateful.

Andy  
 
  

ranikolahdd
Member
 

Re: Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 04:06

If it was a Ness it can be raid right?  
 
  

schlecht
Member
 

Re: Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 04:11

Probably best way would be with the header and footer. How big is the drive?
_________________
schlecht 
 
  

Andy
Senior Member
 

Re: Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 11:48

I don't think it was part of a raid as there is only the one disk, its a large disk too 120GBs. I agree best option is to extract data using the header & footer, but can't find a footer.

Andy  
 
  

ranikolahdd
Member
 

Re: Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 12:49

why do not you scan it with somethimk just to see is there anyhing else.  
 
  

schlecht
Member
 

Re: Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 13:20

If you have the header information, open a hex editor and search on that. With that you may be able to find the file, then you can manually restore it. Also in Winhex at least you can attempt to do data carving with just the header, obviously it's more reliable with both the header and footer since it knows where to stop.

I guess you don't have a working .qbw file that you can look at to get the info, huh?
_________________
schlecht 
 
  

Andy
Senior Member
 

Re: Quickbooks .qbw file recovery

Post Posted: Aug 27, 05 15:10

Correct, I want to carve out the .qbw file. I have a header signature, but no footer. I have EnCase so finding hits for a header isn't a problem, its knowing where to stop. There is no file structure what-so-ever, its all unallocated clusters.

Andy  
 

Page 1 of 3
Page 1, 2, 3  Next