Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] Forensic help?
From: Jason Coombs (jasoncscience.org)
Date: Sun Sep 11 2005 - 18:42:26 CDT
Red Leg wrote:
> I was wondering if anyone knows of a program/system that I can purchase, as
> a private individual, that will allow me to
> 3) Find any CONVENTIONALLY erased files?
> -- This would be either a Windows NTFS or FAT32 drive.
Use dcfldd to make the drive image.
Then use Recover My Files and/or Mount Image Pro + your preferred
deleted file recovery software. Mount Image Pro gives you the ability to
mount raw forensic drive images produced using dd as well as EnCase
forensic image file sets.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/