Hello,
The roommate of a friend "accidentally" deleted some 2000 photos off his off his Mac desktop.
Are there any tools that could be used to recover this? Preferably, OSS or freeware.
Thanks in advance.
http//
Are you familiar with Imaging and carving? You could try imaging the hard drive at the physical level with DD then carving the image using scalpel should all else fail.
by doing
dd if=\\.\PhysicalDrive1 of=C\MAC.imz status=on totalhashformat=#hash# conv=sync,noerror hashlog=C\mac_md5.txt
this will image the drive
The next step is to look at either foremost or scalpel(both Free utilities) to carve the images based on header and footer, on a mac they can be just about anything, TIffs and PNG are common aswell as Jpg.
If you need help on the command for Scalpel let me know.
Have a great day lol
Have a look at this thread … http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=2166
-)