The tag has no wiki summary.

learn more… | top users | synonyms

6
votes
1answer
5k views

dd_rescue vs dcfldd vs dd

What are the main differences between dd_rescue, dcfldd, and dd? In what situations would you use one over the other? Why are there three different yet simliar programs?
25
votes
17answers
6k views

How can I physically destroy data from a failed HDD?

I have a broken HDD that contains sensitive data. Since no software can access the disk, I can't wipe it using any of the tools generally suggested. Breaking the disk physically into very small ...
0
votes
2answers
139 views

Where can I find a complete list of all the logs in the system?

I'd like to learn more about forensic analysis, and I'm trying to do the challenges from Project Honeynet. I need to check the logfiles and find the IP's that connected remotely to the computer. I ...
11
votes
2answers
6k views

How to find out when a disc (DVD) has been written/burned?

Is there a way/tool to determine the date and time when a disc has been written/burned with high certainty? This is about data forensics and should be a solid proof. I already tried IsoBuster, but it ...
0
votes
2answers
1k views

Read (repair) data from broken floppy disc on a linux system

How can i read an old floppy disk under Linux that has some problematic sectors? In times of DOS people used magic tools like Norton Disk Doctor and others. Some of these tools read the broken part ...
3
votes
0answers
339 views

Data Recovery using testDisk failing

Continuation of this question: I am trying to recover an accidentally formatted partition using TestDisk. After selecting the partition and selecting Undeleted, it says, No deleted file found. ...
1
vote
0answers
189 views

How to find out when an audio disc (CD) has been written/burned?

Is there a way/tool to determine the date and time when an audio disc (CD) has been written/burned? I am aware of How to find out when a disc (DVD) has been written/burned? but the accepted solution ...
1
vote
1answer
334 views

What is the best way to undelete some photos on Linux? Is there any way to use foremost to only recover files that only contain some text?

I accidentaly deleted some digital photos I had recently taken, and I wanted to undelete them. I found out about Foremost, and it allows me to recover jpg files, but will fo that with all of the ...
0
votes
2answers
420 views

Create Virtual Machine from Encase image

I have used Encase to capture a disk image in a forensics nvestigation. The problem is that a certain application that resides in the image won't run if it is not installed properly. I want to boot ...