DOCSLIB.ORG

Disk Recovery Tools

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Disk Recovery Tools If you are looking to recover data from a drive that is at least potentially failing, you should first resort to try to make a clone/image of that drive to a backup drive. Tools like DiskDrill on MacOS, or Clonezilla and DDrescue are great at doing this. Linux can also be a great last resort OS to try to recover data from a drive if you keep running into issues on Windows or MacOS pmount dd / ddRescue CloneZilla Repair/Fix HFS+ (macOS) partition using Ubuntu TestDisk pmount pmount manual pmount is a device mounting solution that simplifies mounting and will automatically try to remount any devices that may eject on their own. Very useful for doing data recovery on misbehaving drives. sudo apt install pmount dd / ddRescue Install ddrescue through the gddrescue package dd is a recovery tool probably found on every UNIX system. It is built to be lightweight, simple, and available. However, ddrescue (GNU) is more sophisticated algorithm to read "good" or "big" blocks first and then more damaged areas later to help reduce the amount of data read in a single operation. Install gddrescue package containing ddrescue (GNU) by entering this command: sudo apt install gddrescue References https://opensource.com/article/18/7/how-use-dd-linux https://askubuntu.com/questions/803789/testdisk-is-showing-wrong-size-of-drive https://superuser.com/questions/1024643/in-which-case-should-i-prefer-dd-over-gnu- ddrescue Manual https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html CloneZilla CloneZilla is useful disk cloning software that can be installed using Windows, MacOS, or Linux. sudo apt install clonezilla Using the uMount command, You will need to unmount the drives that you want to restore from / clone to: umount /dev/yourdrive #i.e. umount /dev/sdb/ umount /dev/sdc/ Repair/Fix HFS+ (macOS) partition using Ubuntu sudo apt-get install hfsprogs # Use fdisk to find the Mac Partition. sudo fdisk -l Disk /dev/sda: 465.8 GiB, 500107862016 bytes, 976773168 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: 00006451-5A98-0000-F944-0000E3560000 Device Start End Sectors Size Type /dev/sda1 40 409639 409600 200M EFI System We want to do a FSCK check on the mac partition. sda1 is the EFI partition, so the mac partition should be sda2 (verify this in fdisk). sudo fsck.hfsplus -fryd /dev/sda2 # -f will force a filesystem check even if the specified device is "clean". # -r will try to rebuild the catalog file on the specified file system # -y Tries to repair fielsystem errors automatically during the check TestDisk If you are trying to recover data from a failing hard drive, try to clone the drive first. Resort to TestDisk only if that fails. Also, you should really only try to use TestDisk on a recovered image on a healthy disk rather than a damaged image on a failing drive. The reason to use it in this way is because the write operations that TestDisk performs will likely aggravate or further damage the failing drive more. TestDisk is an excellent multi-purpose repair software. It can perform repairs on most partitions and partition tables, and make non-booting disks bootable again. It can also help in a pinch with data recovery, though you should run it on secured and recovered data only (see the warning above). Check https://www.cgsecurity.org/wiki/TestDisk#Filesystems for a complete list of supported filesystems. Install TestDisk On Linux, TestDisk is really easy to install via package management. Otherwise, if you use TestDisk on Windows or MacOS you will have to compile binaries to run TestDisk on those platforms. sudo apt upgrade sudo apt update sudo apt install testdisk Basic Commands Run TestDisk sudo testdisk Run TestDisk and provide debugging and a log file. sudo testdisk /debug /log TestDisk - Data Recovery Examples https://www.cgsecurity.org/wiki/Data_Recovery_Examples .
Recommended publications
  • How to Find out the IP Address of an Omron

    How to Find out the IP Address of an Omron

    Communications Middleware/Network Browser How to find an Omron Controller’s IP address Valin Corporation | www.valin.com Overview • Many Omron PLC’s have Ethernet ports or Ethernet port options • The IP address for a PLC is usually changed by the programmer • Most customers do not mark the controller with IP address (label etc.) • Very difficult to communicate to the PLC over Ethernet if the IP address is unknown. Valin Corporation | www.valin.com Simple Ethernet Network Basics IP address is up to 12 digits (4 octets) Ex:192.168.1.1 For MOST PLC programming applications, the first 3 octets are the network address and the last is the node address. In above example 192.168.1 is network address, 1 is node address. For devices to communicate on a simple network: • Every device IP Network address must be the same. • Every device node number must be different. Device Laptop EX: Omron PLC 192.168.1.1 192.168.1.1 Device Laptop EX: Omron PLC 127.27.250.5 192.168.1.1 Device Laptop EX: Omron PLC 192.168.1.3 192.168.1.1 Valin Corporation | www.valin.com Omron Default IP Address • Most Omron Ethernet devices use one of the following IP addresses by default. Omron PLC 192.168.250.1 OR 192.168.1.1 Valin Corporation | www.valin.com PING Command • PING is a way to check if the device is connected (both virtually and physically) to the network. • Windows Command Prompt command. • PC must use the same network number as device (See previous) • Example: “ping 172.21.90.5” will test to see if a device with that IP address is connected to the PC.
  • Disk Clone Industrial

    Disk Clone Industrial

    Disk Clone Industrial USER MANUAL Ver. 1.0.0 Updated: 9 June 2020 | Contents | ii Contents Legal Statement............................................................................... 4 Introduction......................................................................................4 Cloning Data.................................................................................................................................... 4 Erasing Confidential Data..................................................................................................................5 Disk Clone Overview.......................................................................6 System Requirements....................................................................................................................... 7 Software Licensing........................................................................................................................... 7 Software Updates............................................................................................................................. 8 Getting Started.................................................................................9 Disk Clone Installation and Distribution.......................................................................................... 12 Launching and initial Configuration..................................................................................................12 Navigating Disk Clone.....................................................................................................................14
  • Chapter 19 RECOVERING DIGITAL EVIDENCE from LINUX SYSTEMS

    Chapter 19 RECOVERING DIGITAL EVIDENCE from LINUX SYSTEMS

    Chapter 19 RECOVERING DIGITAL EVIDENCE FROM LINUX SYSTEMS Philip Craiger Abstract As Linux-kernel-based operating systems proliferate there will be an in­ evitable increase in Linux systems that law enforcement agents must process in criminal investigations. The skills and expertise required to recover evidence from Microsoft-Windows-based systems do not neces­ sarily translate to Linux systems. This paper discusses digital forensic procedures for recovering evidence from Linux systems. In particular, it presents methods for identifying and recovering deleted files from disk and volatile memory, identifying notable and Trojan files, finding hidden files, and finding files with renamed extensions. All the procedures are accomplished using Linux command line utilities and require no special or commercial tools. Keywords: Digital evidence, Linux system forensics !• Introduction Linux systems will be increasingly encountered at crime scenes as Linux increases in popularity, particularly as the OS of choice for servers. The skills and expertise required to recover evidence from a Microsoft- Windows-based system, however, do not necessarily translate to the same tasks on a Linux system. For instance, the Microsoft NTFS, FAT, and Linux EXT2/3 file systems work differently enough that under­ standing one tells httle about how the other functions. In this paper we demonstrate digital forensics procedures for Linux systems using Linux command line utilities. The ability to gather evidence from a running system is particularly important as evidence in RAM may be lost if a forensics first responder does not prioritize the collection of live evidence. The forensic procedures discussed include methods for identifying and recovering deleted files from RAM and magnetic media, identifying no- 234 ADVANCES IN DIGITAL FORENSICS tables files and Trojans, and finding hidden files and renamed files (files with renamed extensions.
  • Your Performance Task Summary Explanation

    Your Performance Task Summary Explanation

    Lab Report: 11.2.5 Manage Files Your Performance Your Score: 0 of 3 (0%) Pass Status: Not Passed Elapsed Time: 6 seconds Required Score: 100% Task Summary Actions you were required to perform: In Compress the D:\Graphics folderHide Details Set the Compressed attribute Apply the changes to all folders and files In Hide the D:\Finances folder In Set Read-only on filesHide Details Set read-only on 2017report.xlsx Set read-only on 2018report.xlsx Do not set read-only for the 2019report.xlsx file Explanation In this lab, your task is to complete the following: Compress the D:\Graphics folder and all of its contents. Hide the D:\Finances folder. Make the following files Read-only: D:\Finances\2017report.xlsx D:\Finances\2018report.xlsx Complete this lab as follows: 1. Compress a folder as follows: a. From the taskbar, open File Explorer. b. Maximize the window for easier viewing. c. In the left pane, expand This PC. d. Select Data (D:). e. Right-click Graphics and select Properties. f. On the General tab, select Advanced. g. Select Compress contents to save disk space. h. Click OK. i. Click OK. j. Make sure Apply changes to this folder, subfolders and files is selected. k. Click OK. 2. Hide a folder as follows: a. Right-click Finances and select Properties. b. Select Hidden. c. Click OK. 3. Set files to Read-only as follows: a. Double-click Finances to view its contents. b. Right-click 2017report.xlsx and select Properties. c. Select Read-only. d. Click OK. e.
  • Problem Solving and Unix Tools

    Problem Solving and Unix Tools

    Problem Solving and Unix Tools Command Shell versus Graphical User Interface • Ease of use • Interactive exploration • Scalability • Complexity • Repetition Example: Find all Tex files in a directory (and its subdirectories) that have not changed in the past 21 days. With an interactive file roller, it is easy to sort files by particular characteristics such as the file extension and the date. But this sorting does not apply to files within subdirectories of the current directory, and it is difficult to apply more than one sort criteria at a time. A command line interface allows us to construct a more complex search. In unix, we find the files we are after by executing the command, find /home/nolan/ -mtime +21 -name ’*.tex’ To find out more about a command you can read the online man pages man find or you can execute the command with the –help option. In this example, the standard output to the screen is piped into the more command which formats it to dispaly one screenful at a time. Hitting the space bar displays the next page of output, the return key displays the next line of output, and the ”q” key quits the display. find --help | more Construct Solution in Pieces • Solve a problem by breaking down into pieces and building back up • Typing vs automation • Error messages - experimentation 1 Example: Find all occurrences of a particular string in several files. The grep command searches the contents of files for a regular expression. In this case we search for the simple character string “/stat141/FINAL” in all files in the directory WebLog that begin with the filename “access”.
  • What Is UNIX? the Directory Structure Basic Commands Find

    What Is UNIX? the Directory Structure Basic Commands Find

    What is UNIX? UNIX is an operating system like Windows on our computers. By operating system, we mean the suite of programs which make the computer work. It is a stable, multi-user, multi-tasking system for servers, desktops and laptops. The Directory Structure All the files are grouped together in the directory structure. The file-system is arranged in a hierarchical structure, like an inverted tree. The top of the hierarchy is traditionally called root (written as a slash / ) Basic commands When you first login, your current working directory is your home directory. In UNIX (.) means the current directory and (..) means the parent of the current directory. find command The find command is used to locate files on a Unix or Linux system. find will search any set of directories you specify for files that match the supplied search criteria. The syntax looks like this: find where-to-look criteria what-to-do All arguments to find are optional, and there are defaults for all parts. where-to-look defaults to . (that is, the current working directory), criteria defaults to none (that is, select all files), and what-to-do (known as the find action) defaults to ‑print (that is, display the names of found files to standard output). Examples: find . –name *.txt (finds all the files ending with txt in current directory and subdirectories) find . -mtime 1 (find all the files modified exact 1 day) find . -mtime -1 (find all the files modified less than 1 day) find . -mtime +1 (find all the files modified more than 1 day) find .
  • Deviceinstaller User Guide

    Deviceinstaller User Guide

    Device Installer User Guide Part Number 900-325 Revision C 03/18 Table of Contents 1. Overview ...................................................................................................................................... 1 2. Devices ........................................................................................................................................ 2 Choose the Network Adapter for Communication ....................................................................... 2 Search for All Devices on the Network ........................................................................................ 2 Change Views .............................................................................................................................. 2 Add a Device to the List ............................................................................................................... 3 View Device Details ..................................................................................................................... 3 Device Lists ................................................................................................................................. 3 Save the Device List ................................................................................................................ 3 Open the Device List ............................................................................................................... 4 Print the Device List ................................................................................................................
  • Netinfo 2009-06-11 Netinfo 2009-06-11

    Netinfo 2009-06-11 Netinfo 2009-06-11

    Netinfo 2009-06-11 Netinfo 2009-06-11 Microsoft släppte 2009-06-09 tio uppdateringar som täpper till 31 stycken säkerhetshål i bland annat Windows, Internet Explorer, Word, Excel, Windows Search. 18 av buggfixarna är märkta som kritiska och elva av dem är märkta som viktiga, uppdateringarna finns för både servrar och arbetsstationer. Säkerhetsuppdateringarna finns tillgängliga på Windows Update. Den viktigaste säkerhetsuppdateringen av de som släpptes är den för Internet Explorer 8. Netinfo 2009-06-11 Security Updates available for Adobe Reader and Acrobat Release date: June 9, 2009 Affected software versions Adobe Reader 9.1.1 and earlier versions Adobe Acrobat Standard, Pro, and Pro Extended 9.1.1 and earlier versions Severity rating Adobe categorizes this as a critical update and recommends that users apply the update for their product installations. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system. Netinfo 2009-06-11 SystemRescueCd Description: SystemRescueCd is a Linux system on a bootable CD-ROM for repairing your system and recovering your data after a crash. It aims to provide an easy way to carry out admin tasks on your computer, such as creating and editing the partitions of the hard disk. It contains a lot of system tools (parted, partimage, fstools, ...) and basic tools (editors, midnight commander, network tools). It is very easy to use: just boot the CDROM. The kernel supports most of the important file systems (ext2/ext3/ext4, reiserfs, reiser4, btrfs, xfs, jfs, vfat, ntfs, iso9660), as well as network filesystems (samba and nfs).
  • Diskgenius User Guide (PDF)

    Diskgenius User Guide (PDF)

    www.diskgenius.com DiskGenius® User Guide The information in this document is subject to change without notice. This document is not warranted to be error free. Copyright © 2010-2021 Eassos Ltd. All Rights Reserved 1 / 236 www.diskgenius.com CONTENTS Introduction ................................................................................................................................. 6 Partition Management ............................................................................................................. 6 Create New Partition ........................................................................................................ 6 Active Partition (Mark Partition as Active) .............................................................. 10 Delete Partition ................................................................................................................ 12 Format Partition ............................................................................................................... 14 Hide Partition .................................................................................................................... 15 Modify Partition Parameters ........................................................................................ 17 Resize Partition ................................................................................................................. 20 Split Partition ..................................................................................................................... 23 Extend
  • [D:]Path[...] Data Files

    [D:]Path[...] Data Files

    Command Syntax Comments APPEND APPEND ; Displays or sets the search path for APPEND [d:]path[;][d:]path[...] data files. DOS will search the specified APPEND [/X:on|off][/path:on|off] [/E] path(s) if the file is not found in the current path. ASSIGN ASSIGN x=y [...] /sta Redirects disk drive requests to a different drive. ATTRIB ATTRIB [d:][path]filename [/S] Sets or displays the read-only, archive, ATTRIB [+R|-R] [+A|-A] [+S|-S] [+H|-H] [d:][path]filename [/S] system, and hidden attributes of a file or directory. BACKUP BACKUP d:[path][filename] d:[/S][/M][/A][/F:(size)] [/P][/D:date] [/T:time] Makes a backup copy of one or more [/L:[path]filename] files. (In DOS Version 6, this program is stored on the DOS supplemental disk.) BREAK BREAK =on|off Used from the DOS prompt or in a batch file or in the CONFIG.SYS file to set (or display) whether or not DOS should check for a Ctrl + Break key combination. BUFFERS BUFFERS=(number),(read-ahead number) Used in the CONFIG.SYS file to set the number of disk buffers (number) that will be available for use during data input. Also used to set a value for the number of sectors to be read in advance (read-ahead) during data input operations. CALL CALL [d:][path]batchfilename [options] Calls another batch file and then returns to current batch file to continue. CHCP CHCP (codepage) Displays the current code page or changes the code page that DOS will use. CHDIR CHDIR (CD) [d:]path Displays working (current) directory CHDIR (CD)[..] and/or changes to a different directory.
  • Recovering a Lost Enable Password

    Recovering a Lost Enable Password

    APPENDIX E Recovering a Lost Enable Password This appendix describes how to recover a password that you configured with the enable command (enable password). Note You can recover a lost enable password, but not a password that you configured with the enable secret command (enable secret password). This password is encrypted and must be replaced with a new enable secret password. See the “Hot Tips” section on Cisco Connection Online (CCO) for information on replacing enable secret passwords. Follow these steps to recover a lost enable password: Step 1 Connect an ASCII terminal or a PC running a terminal emulation program to the Console port. For more information, see the Cisco 805 Router Hardware Installation Guide. Step 2 Configure the terminal at 9600 baud, 8 data bits, no parity, and 1 stop bit. Step 3 Reboot the router. Step 4 From user EXEC mode, display the existing configuration register value: Router> show version Step 5 Record the setting of the configuration register. The setting is usually 0x2102 or 0x102. Step 6 Record the break setting. • Break enabled—bit 8 is set to 0. • Break disabled (default setting)—bit 8 is set to 1. Recovering a Lost Enable Password E-1 Note To enable break, enter the config-register 0x01 global configuration command. Step 7 Do one of the following: • If break is enabled, go to Step 8. • If break is disabled, turn the router to STANDBY, wait 5 seconds, and turn it to ON again. Before the terminal displays Boot......, press Escape or Control-C. The terminal displays the ROM monitor prompt (boot #).
  • Service Information

    Service Information

    Service Information VAS Tester Number: AVT-14-20 Subject: VAS Diagnostic Device Hard Disc Maintenance Date: Sept. 24, 2014 Supersedes AVT-12-12 due to updated information. 1.0 – Introduction If persistent diagnostic software or Windows® 7 operating system error messages are displayed while installing or using the diagnostic software, use the Windows CHKDSK utility to check hard disk integrity and fix logical file system errors. CHKDSK can also handle some physical errors and may be able to recover lost data that is readable. We recommend the CHKDSK utility be run on a regular basis on all VAS diagnostic devices in service. Consult with your dealership Systems Administrator or IT Professional about checking the integrity of the hard disk as described below on a regular basis, as well as regular performance of the Windows DEFRAG utility. 2.0 – Procedure Prerequisites: Device plugged into power adapter and booted to Windows desktop 1. Go to Windows Start > Computer 2. Right click/select Local Disk (C:) and select Properties from the dropdown menu: Continued… 2/ Page 1 of 3 © 2014 Audi of America, Inc. All rights reserved. Information contained in this document is based on the latest information available at the time of printing and is subject to the copyright and other intellectual property rights of Audi of America, Inc., its affiliated companies and its licensors. All rights are reserved to make changes at any time without notice. No part of this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, nor may these materials be modified or reposted to other sites, without the prior expressed written permission of the publisher.