Slashdot Mirror

---DCO and HPA (Host Protected Area of HDDs)---------
http://en.wikipedia.org/wiki/H...
http://www.forensicswiki.org/w...
http://hddguru.com/software/20...
http://hddguru.com/software/20...
http://hddguru.com/software/20...
http://www.itsecure.at/hparemo...
http://www.sleuthkit.org/infor...

DCO and HPA (Host Protected Area of Hard Disk Drives)

---DCO and HPA (Host Protected Area of HDDs)---------
http://en.wikipedia.org/wiki/H...
http://www.forensicswiki.org/w...
http://hddguru.com/software/20...
http://hddguru.com/software/20...
http://hddguru.com/software/20...
http://www.itsecure.at/hparemo...
http://www.sleuthkit.org/infor...

http://en.wikipedia.org/wiki/H...
http://www.forensicswiki.org/w...
http://hddguru.com/software/20...
http://hddguru.com/software/20...
http://hddguru.com/software/20...
http://www.itsecure.at/hparemo...
http://www.sleuthkit.org/infor...

I'm not a full time professional in data recovery but I am trained and certified in hard drive forensics.

I'm assuming you're talking about recovering data that is lost from corruption errors, not the drive itself dying.

There's a variety of free command line tools that are used for recovering data from corrupted hard drives that function at various levels (such as inodes), but really, unless you have training in them or need something really specific, the graphic (via web browser) frontend Autopsy is the way to go:

http://www.sleuthkit.org/autopsy/

If I'm looking for a specific type of file, sometimes I'll use Foremost:

http://foremost.sourceforge.net/

As far as commercial software, EnCase commonly used but pricey compared to Autopsy.

http://www.guidancesoftware.com/

The key thing with either the commercial or non-commercial options is to avoid damaging the file system you're working on. This means that if you're attempting to mount the drive from a working machine that you do so read-only (if you get really into this, there are hard drive -> USB mounts that block all writes) and if possible you clone the drive into an image and work on that rather than the original. The free version to do that is dd. Be sure to use the noerror option on it to make sure that a bad sector doesn't cause the process to fail.

Also, clone the entire drive, not just the partition in case there's data that you need outside of the partition. In other words, do this:

dd if=/dev/hda of=/forensics/image.dd conv=noerror,sync

Rather than this:

dd if=/dev/hda1 of=/forensics/image.dd conv=noerror,sync

Well stated and correct. I've unfortunately been thrown the task (as many in the IT world get daily) more than once to recover deleted files from a employee no longer with the company, or just recover files from a damaged system or hard drive. Usually the option of paying a recovering shop $2000 - $5000 to retrieve the data isn't even a consideration for an option, although definitely preferred. First and foremost I make an exact copy of the drive using the dd utility, such as the following: dd if=/dev/sda of=/dev/sdb bs=512 conv=noerror,sync Then all recovery is done on the copy made, so worst case scenario and everything including the cat goes south, it's no harm - no foul, since you can just make another copy and try again. Which tool to use really depends on what type of data your trying to recover, as each program targets specific functionality. Many do just try to repair partition tables, which is generally not what you want. I've had great success using ddrescue, and is probably my preferred - again, depending on what your goal in recovery is. Another great tool is http://www.cgsecurity.org/wiki/TestDisk (Testdisk) which works well. Others that are a little more involved to operate and setup are http://www.student.dtu.dk/~s042078/magicrescue/manpage.html (magicrescue) and http://www.sleuthkit.org/sleuthkit/ (the sleuthkit) and there is some good information at http://dftt.sourceforge.net/ (http://dftt.sourceforge.net/) which might provide help and insight. No matter how you look at it though, your in for a fun ride, so best to stock up on pain killers and red bull.

The general procedure I use is:

1) Get and install Debugging Tools for Windows for your platform.

2) Run kernrate.exe from the resource kit tools to determine if the problem is an I/O or CPU limit. (See here for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.

3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer to determine which file actually contains the code which is executing.

4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK, and the NIST hash database to audit your machine for bad files.

5) Run Process Monitor and see who's responsible for all the I/O.

6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.

Brian Carrier's File System Forensics is a staple book for anyone in forensics.

I think that the majority of others are specialty training guides provided to those in the field, or just basic knowledge gained from experience.

If you really want to learn more, download Sleuthkit/Autopsy (Sleuthkit is cmd line forensics tools, Autopsy is a web-based frontend to them) and just play. They're FOSS, and you'll learn more this way than any other. The tools were also written by Brian Carrier, author of the book above.

The Sluth Kit.

• The Coroner's Toolkit (getting a bit dated)
  
• The Sleuth Kit
  
• Helix
  

Dear anonymous,
As always, google is your friend.
My learning disabled kid brother doesn't know what data forensics is, but he knows how to use google.
Use it.

http://www.google.com/search?q=knoppix+validation& sourceid=firefox&start=0&start=0&ie=utf-8&oe=utf-8
http://www.google.com/search?q=linux+forensics&sou rceid=firefox&start=0&start=0&ie=utf-8&oe=utf- 8

PDF - KNOPPIX Bootable CD Validation Study for Live Forensic Preview ...

Linux-Forensics.com Home of the Penguin Sleuth Bootable CD

Knoppix security tools distribution Knoppix STD (security tools distribution)

From Australian DoD page:http://www.dsd.gov.au/library/software/flag/
FLAG uses the SleuthKit tool from www.sleuthkit.org to analyse dd images. By putting inode information in the database it is possible to cross-correlate file properties, and simplify the forensic analysis process.

They're much better off taking one of the @stake classes. They don't pretend to teach you how to be a 'hacker', but how to secure your systems. They do show several (four or five) outdated scriptkiddy hacks, but mostly, the focus is making people aware of issues and giving them a toolkit to try and secure it.

I wish it had been a /little/ more technical, but in their defense, we did spend 90% of the time actually doing lab exersizes, and I did take some good stuff away from it. My boss, who is our director of IT, went with me, and really loved it; His focus is not as security focused as mine, so I think a lot more of it was new to him. Anyway, at least you know you've got really good instructors, so if you are curious about a specific aspect of security, they can sit down and teach you about that, or if they don't know, they can get somone who does to answer it.

Also, it was pretty cool to have the guy who wrote The Sleuth Kit as an instructor. Needless to say, the forensics section was pretty interesting.

I didn't spend a ton of time picking through your thread, but did you take an image of the filesystem and work off that instead of the original? If you did, and you still have the image around, you may be interested in The Sleuth Kit... it claims to support ext3. I haven't tried it myself but plan to throw together a junk box and give it a try. It looks useful. If it makes you feel any better about your choice of filesystem, recovering deleted files is *damned hard* on NTFS as well... it's only the old FAT?? systems that really have a leg up on Linux anymore :-)