Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: ant888
New Today: 3
New Yesterday: 0
Overall: 29286

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Hash calculation between image and original file
 Final Year Project
 Android devices with PIN screen lock and without USBdebb. on
 Can file creation and modifications on pendrives be found?
 Viewing real MAC times of a timestomped file

Computer Forensics World Forums


Pages Served
We received
49944836
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Does imaging HDD capture deleted files too?
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Does imaging HDD capture deleted files too?
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues
View previous topic :: View next topic  
Author Message
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Fri Sep 23, 2016 9:29 am    Post subject: Does imaging HDD capture deleted files too? Reply with quote

Does imaging HDD capture a copy of all the deleted files on that HDD too?
I'm guessing the answer is 'yes', but had to ask.
Back to top
View user's profile
cybercop
Newbie
Newbie


Joined: Nov 01, 2005
Posts: 551
Location: Marion, Indiana, USA

PostPosted: Fri Sep 23, 2016 9:47 am    Post subject: Reply with quote

Depends on the method used to image it.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Fri Sep 23, 2016 1:04 pm    Post subject: What methods are you referencing? Reply with quote

cybercop wrote:
Depends on the method used to image it.

Hi
What type of methods are you referring to? Not all imaging
software companies use the same method to image?

Thanks in advance.
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Tue Sep 27, 2016 12:12 pm    Post subject: Reply with quote

Are you making a logical copy or a bit-for-bit image?
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Thu Oct 20, 2016 6:00 pm    Post subject: logical copy vs bit for bit Reply with quote

PreferredUser wrote:
Are you making a logical copy or a bit-for-bit image?


Hi
Not sure what the difference between the two are? Could you
kindly explain pls? When is it appropriate to use either method?

Thanks
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Fri Oct 21, 2016 11:42 am    Post subject: Reply with quote

"http://lmgtfy.com/?q=logical+copy"
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Mon Oct 24, 2016 5:44 pm    Post subject: recommendation? Reply with quote

cybercop wrote:
Depends on the method used to image it.

Which one do you recommend?
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Mon Oct 24, 2016 7:37 pm    Post subject: Logical copy required Reply with quote

PreferredUser wrote:
"http://lmgtfy.com/?q=logical+copy"

A logical copy as I need the files on the USB before I got
the error message. Bit-to bit is not required as I'm not after access to deleted files on the USB.

Note: there is something about the USB now being in RAW format even though it wasn't before the error. Does this mean the files are deleted per se or sitting there under RAW format?

What would happen if I made a copy in both methods?
What's the next step from here? Thanks.
Back to top
View user's profile
cybercop
Newbie
Newbie


Joined: Nov 01, 2005
Posts: 551
Location: Marion, Indiana, USA

PostPosted: Tue Oct 25, 2016 6:20 am    Post subject: Reply with quote

So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.
Back to top
View user's profile
cybercop
Newbie
Newbie


Joined: Nov 01, 2005
Posts: 551
Location: Marion, Indiana, USA

PostPosted: Tue Oct 25, 2016 6:20 am    Post subject: Reply with quote

So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Thu Oct 27, 2016 9:51 am    Post subject: GetBackData has RAW format option? Reply with quote

cybercop wrote:
So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.


I intend to make an image of the USB stick which is in RAW format; reading the manual from GetBackData says:
Start up GetDataBack for either FAT or NTFS, they both create images exactly the same way. If your drive is NTFS you can use GetDataBack for FAT to create the image and vice versa.
source: "https://www.runtime.org/gdbimage.htm"

The USB stick I want to image is in RAW format at the moment but was something else before. It morphed into RAW format by its own doing. Should I proceed with making an image if RAW is not able in GetBackData?

Thanks in advance.


Moderator Note: Direct links are not allowed.
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Thu Oct 27, 2016 11:02 am    Post subject: Reply with quote

It morphed all on its own? Interesting.

There are many articles on recovery from RAW:

"http://www.easeus.com/resource/raw-usb-drive-recovery.htm"
"http://html5.litten.com/updated-how-to-fix-external-disk-drive-suddenly-became-raw/"
"http://superuser.com/questions/422662/how-to-fix-corrupted-filesystem-shows-as-raw-in-usb-device"

Did you use a search engine to research this problem? If you would have provided a complete description of your problem in your original post you would likely have gotten a better answer sooner. Just saying.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Thu Oct 27, 2016 9:58 pm    Post subject: Reply with quote

PreferredUser wrote:
It morphed all on its own? Interesting.

There are many articles on recovery from RAW:

"http://www.easeus.com/resource/raw-usb-drive-recovery.htm"
"http://html5.litten.com/updated-how-to-fix-external-disk-drive-suddenly-became-raw/"
"http://superuser.com/questions/422662/how-to-fix-corrupted-filesystem-shows-as-raw-in-usb-device"

Did you use a search engine to research this problem? If you would have provided a complete description of your problem in your original post you would likely have gotten a better answer sooner. Just saying.

I did some research but your links seem better; I will follow that up.
Thank you for suggestions and help.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Fri Oct 28, 2016 10:20 am    Post subject: Do I need to pay of GetBackData in order to complete recover Reply with quote

cybercop wrote:
So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.

Once GetDataBack recovers the files will it ask for me to buy it in order to finalize the transfer of the recovered files to another drive? If so, then is there a another program that is 100% free? Thanks in advance.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Fri Oct 28, 2016 10:27 am    Post subject: image clone first before recovery? Reply with quote

Should I make an image (clone) of the USB stick first before using an Recovery Software Tools on it? If so, which free open source imaging cloning product do you suggest?
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues All times are GMT + 10 Hours
Goto page 1, 2, 3  Next
Page 1 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.