No matter what but if you work in the IT support business you will have to deal with user’s data. You will have some interesting tasks assigned like:
- Recover data from somebody else’s pc (Live Capture);
- Restore deleted data (Data reconstruction);
- Network Investigation;
- Wipe data.
We need to remember that the machines we use in a corporate environment are property of the company which bought them. Even the data located on those machines are property of the same company. This means that you can receive some requests that look like something that should be done by a computer forensics expert.
In this article I will list some of the most used freeware tools for both Windows and Linux to recover data from a forensic point of view.
What we can recover?
There are software available to recover almost every kind of file (images, music, video, documents like word, excel, etc).
The basic idea is that every kind of file has one or more parts in common (like the header, just to give an example). This means that if we are looking for a specific kind of file we can use the right tool to not only undelete files, but to focus on the ones we really need and try to better recover the ones which have been partially overwritten.
From where we can recover?
The options we have are basically two:
- Recover lost information from RAM (if the machine has not been turned off)
- Recover lost information from DISK (file has been deleted from OS)
How do we recover?
There are different toolsets, frameworks and even small freeware utilities available. Some of them are free others are quite expensive. I’ll put a small list here and I’ll try to cover each one of them in a different, specific article during the next days.
Caine: www.caine-live.net/
MDD: http://sourceforge.net/projects/mdd/
The Volatility Framework: https://www.volatilesystems.com/default/volatility
Windows Forensics Toolchest: http://www.foolmoon.net/security/wft/screenshots.html
Ocfa: http://sourceforge.net/apps/trac/ocfa
ASR Search Engine
New Ubuntu is coming…
