[Wolves] NTFS deleted file recovery

[James Turner]

On Sunday 15 October 2006 23:36, leo sandhu wrote:
> It's not worked :(   I have already seperated all the files into seperate
> directories based upon size and the alleged extension.  Running *.* is
> simply  confirming  that the files are sorted correctly :S

In what way hasn't it worked? Mounting the disc or running file on it? You 
should get output like:

$ mount /dev/hda1 /mnt -t ntfs -o ro
$ cd "/mnt/Documents And Settings/Leo Sandhu"
$ file *
antena1wheel_1.mpg:      MPEG sequence, v1, system multiplex
dotnet-debate.txt:       ASCII English text
intranet-sevices.xcf:    GIMP XCF image data, version 0, 243 x 28, RGB Color
overtime.xls:            Microsoft Excel Worksheet
salary-scale-2004.doc:   Microsoft Office Document
Sheet Music:             directory
usbplug.gif:             GIF image data, version 87a, 317 x 247
workspace:               directory

(where $ represents the shell prompt)

The type information is determined based on file contents - the filename 
extension is ignored. If everything just shows up as "data" (a bad sign) then 
try looking at some of the files (preferably the smaller ones) with
"hexedit <filename>" (assuming this command is available in the Ubuntu Live CD 
or whatever you decide to use) and seeing if anything looks intelligable.

Some specific notes:

 - OpenOffice.org documents are saved as ZIP files containing the elements of
   the document in XML format, so show up as "Zip archive data, at least v2.0
   to extract". Similarly, KOffice documents and Dia diagrams both show up as
   "gzip compressed data, from Unix".

 - Microsoft Office documents seem to show up as either "Microsoft Office
   Document" or as the individual application name, not always consistently
   for a given extension. Presumably this depends on which variant of the
   format was used when the file was saved.

Regards,

James