[Gllug] Linux hard drive forensic tools

Christian Smith csmith at thewrongchristian.org.uk
Mon Jan 23 17:43:18 UTC 2012

On Mon, Jan 23, 2012 at 03:22:14PM +0000, gvim wrote:
> I have reformatted HFS+ Journaled a drive from which I would
> now like to be able to recover some lost data. It was
> originally formatted NTFS. Any chance with Linux/FOSS
> forensic tools? If so, which are recommended for this
> particular task?

Not tried it in anger, only used it to check if anything was
loaded onto a "new" SDCard I got, but try:

It is filesystem agnostic, searches using file headers, so will
have to assume your files to recover are contiguous.

Gllug mailing list  -  Gllug at gllug.org.uk

More information about the GLLUG mailing list