[Wolves] NTFS deleted file recovery

[Ron Wellsted]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

leo sandhu wrote:
> 
> Does anybody know about manipulating file headers?
> 
> In the end I used PhotoRec and succesfully recovered 36GB of data from
> the old 40Gb drive.  The problem now is that although I requested only a
> few  file types -  .pdf .doc .ppt .xl ; the stupid thing has actually
> recovered what looks like every file on that hard disk outside of the
> main "windows" directory and liberally distributed a file extension
> based upon what seems to be luck of the draw.
> 
> This means I now have doc files that are 640mb in size.  Me thinks these
> seem likely to be either MPG or iso files and are easily ignored.  
> However, actually sifting through the thousands of remaining files is
> worse than drowning in custard.  There is some 20Gb of files under 10mb
> in size,
> 
> Please, can anyone tell me a way to easily (or at least more sensibly)
> filter these files, maybe try to reallocate file extensions and check
> for integrity?
> 
> please :S please :S

Mount the disk under Linux (ubuntu live CD?), open up a shell and run
"file" against the files e.g. "file *.*" this will at least identify if
the file is a PDF, Office document, mpeg, iso whatever based on the
content of the file instead of the extension.

HTH


- --
Ron Wellsted
ron at wellsted.org.uk http://www.wellsted.org.uk
N 52.567623, W 2.137621 Linux Counter No. 202120
FWD:519961
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQEVAwUBRTCRZEtP/KMNOfRbAQLolAf9ECVtP7RK0TbSLdDy/cXfIhfoZ0WDl0V4
+XdSiRQOjkt3Omx/ve0HqgNgss8FdCUMz7yDwPBueTXJFU3H4ZLYktqEsR4DYe7D
JGTd9IWHtBWMS0JpXXBA7v0vGZXcm+0v7agF7QusplOKmJsXNY+N/xAucplKF0ik
+7wtFKszWkJIhP7+dpGEaTA/RO3H4WLXXh16pVXiGzATMWjyf6X/bQ9Fl2Cp4uFi
a623fn3F6OXGJuZfcjIyl+eZvlC8a0O080kC0JSd0UJa9vzwKZuY8ZyLBVsWip5l
VZbSSh4pbnTgSMZwS2momgB8QYcejHZDO0sqRtw6DZOlz94mWg04kQ==
=3+mu
-----END PGP SIGNATURE-----