[oclug] Data Recovery Service

[Jacques B.]

On Sat, Jun 21, 2008 at 12:25 AM, Andy Civil <andycivil at gmail.com> wrote:
> I'm slightly surprised that no one has mentioned this:
> http://linuxappfinder.com/package/photorec
> The only problem is that wherever you run it from, you have to have
> somewhere to save the found files TO. That might require some
> Garth-intervention. The wikipedia site claims that it works "with" vista:
> http://en.wikipedia.org/wiki/PhotoRec
> Note that despite the name, it finds other document types too. I guess he
> first wrote it to fish deleted photos off memory cards.
>
> It's also completely indiscriminate, and will find everything.
>
> --
> Andy
That was one of the potential tools to suggest along with foremost,
scalpel, or even autopsy.  But that's if they wished to simply recover
files.  If the goal was to recover the entire physical drive, ddrescue
(not dd_rescue) would be a very good option.  I hadn't bothered with
specific suggestions until I knew if they were looking to recover
files or a logical partition or physical drive.  PhotoRec works quite
well.  Contrary to its name, it does not only do photos.  As you
indicated, it recovers numerous file formats.  Foremost and scalpel
are not quite the same, however their advantage over photorec is that
you can modify the config file to search for only certain file types,
and even add your own file types.

The company that was mentioned to me offline is "Trailing Edge in
Bexeley Place, Bell's Corners".  This company recovered data on a 20
gig drive and burned it to DVD for $60.  Here again it depends if a
user is only looking to recover data files, or the entire system.
Recovering only files means having to re-install the OS and all extra
applications.  Recovering the entire physical drive means you do not
have to re-install anything.  However with Vista I believe it's tied
to the hardware anyhow so I don't believe you could recover it from
one drive to another because it would recognize that the hardware has
changed and probably stop working after a short trial period (2-3
weeks or something like that before you end up with a reduced
functionality system from what I've read) concluding that it's a new
install of the OS on a different system.

Jacques B.