Hi, I want you to help me recover my pictures on my hard drive after formatting in several phases and writing the operating system. And t'il possible that utility Helix will retrieve my images or should t'il invest in software as Encase, FTK. To complete the purchase of these programs are t'ils allowed for individuals ansi that materials investigations. Thank you for your help.
OK two main pieces of FREE software you will need,
FTK Imager - Image the hard drive as a DD image
Carve the images from the DD image using scalpel command line.
Depending on which images you need to carve you need to delete the '#' in front of them in the .conf file.
Hope this was of help, hope your good at command line.
Stephen
Post back on the thread if you get stuck D
Hi stezer2000 and thank you for your help.FTK software imager can not find that the photos that are present on the media. No photo that was deleted from more than 1 year was back. I have the best result with Easy Undelete file but I can not get the photos I want. Please give me a track to follow for me to make progress in my research. I post here a short video demonstration
http//
Is this really the procedure to follow?
Thank you for your help
Binhex
I'd suggest that stezer2000 suggested FTK imager be used to save the data to a drive for recovery so as to not damage the original. Imager would not find photos. It makes a backup so that scalpel could then find the files. Once you have make a backup using Imager, then run scalpel on the backup.
I'd suggest that stezer2000 suggested FTK imager be used to save the data to a drive for recovery so as to not damage the original. Imager would not find photos. It makes a backup so that scalpel could then find the files. Once you have make a backup using Imager, then run scalpel on the backup.
Sorry I should have elaborated more, use FTK to make a forensic image of the disk its self and then carve the images out of the image of the drive using scalpel D