[Wolves] NTFS deleted file recovery

Ron Wellsted ron at wellsted.org.uk
Sat Oct 14 08:27:44 BST 2006

Hash: SHA1

leo sandhu wrote:
> Does anybody know about manipulating file headers?
> In the end I used PhotoRec and succesfully recovered 36GB of data from
> the old 40Gb drive.  The problem now is that although I requested only a
> few  file types -  .pdf .doc .ppt .xl ; the stupid thing has actually
> recovered what looks like every file on that hard disk outside of the
> main "windows" directory and liberally distributed a file extension
> based upon what seems to be luck of the draw.
> This means I now have doc files that are 640mb in size.  Me thinks these
> seem likely to be either MPG or iso files and are easily ignored.  
> However, actually sifting through the thousands of remaining files is
> worse than drowning in custard.  There is some 20Gb of files under 10mb
> in size,
> Please, can anyone tell me a way to easily (or at least more sensibly)
> filter these files, maybe try to reallocate file extensions and check
> for integrity?
> please :S please :S

Mount the disk under Linux (ubuntu live CD?), open up a shell and run
"file" against the files e.g. "file *.*" this will at least identify if
the file is a PDF, Office document, mpeg, iso whatever based on the
content of the file instead of the extension.


- --
Ron Wellsted
ron at wellsted.org.uk http://www.wellsted.org.uk
N 52.567623, W 2.137621 Linux Counter No. 202120
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


More information about the Wolves mailing list