Save that Data

1
Save that Data

• Computer File and Drive
• Protection and Recovery Resources

2
Terence Sullivan, Shiloh/Chrisman Schools

• Save That Data. Everyone has had that
  experience of losing critical documents. Almost
  always the data is recoverable for no cost. A
  simple USB memory stick can carry all the free
  tools needed for recovery of a single deleted
  file to a completely trashed hard drive. A
  tool-kit with how-to instructions will be
  available. (Appropriate for all grade levels.)

tsulliva_at_comwares.net
3
Nice Tool - Bonus

• Internet Explorer History Viewer IEVH
• http//www.nirsoft.net/utils/iehv.html
• Will display Internet History in a complete and
  organized format for every user on a computer
• Session Philosophy using all free software or
  utilities included with OS

4
Backup and Archive

• Best defense is a good offense
• Recycle Bin ONLY local drives
• CD/DVD burners
• Onetouch Backup external drive
• Ntbackup (Windows)
• Syncback
• Cobian Backup

5
Windows Archiving Tools

• System Restore ONLY system files
• Volume Shadow Copy (VSC)
• NTBackup
• Windows Resource Kit Tools
• Robocopy

6
How Drives Work

• Files are stored magnetically or optically on the
  drive.
• Drive is organized in logical parts
• Sectors, Tracks, Cylinders, Partitions
• File is written onto the drive and the
  LOCATION(s) is recorded in the file tables
• These apply to
• Hard Drive, Floppy Drive, CD, CDV, Flash Memory,
  SD Cards, even digital tape drives

7
How Drives Work

• Examples
• Hard Drive
• Floppy Drive
• CD Rom

8
Signs that your drive is damaged or failing

• Strange noises or grinding sound
• SLOW to open/save a file or boot
• Unresponsiveness
• Freezes and locks up.
• Blue screen of death
• TIP check the event logs!

9
What happens when a file is lost

• Erased
• Really just delete the file table so the
  reference to what and WHERE is lost
• Overwritten
• Remagnetize the same parts of the drive or redo
  the reflective ink on the CD/DVD
• Drive Partition is Lost
• Boot record is corrupted and the beginning/ending
  points for the logical drive are lost
• Physical Damage
• Head crash, disk scratched, drive motor issues,
  drive controller issues

10
Recover from Minor Drive Damage

• CD-DVD
• Clean the drive with water and lint free cloth
• Scratches with polisher or toothpaste (fine
  abrasive)
• Crack run it in a SLOW drive (older drive)
• Disk Drive minor corruption
• Included OS Tools
• Chkdsk (Win), FSCK (Linux), Disk Utility Mac
• SFC (system file checker) in Windows

11
Windows Tools

• If system boots it may be possible to run and fix
  from inside Windows
• System Restore to revert and recover system files
  if it is corruption damage and not hard drive
  failure
• CHKDSK gui or command line
• Chkdsk /R
• SFC command line
• Scf /scannow
• Reference Site - http//ss64.com/

12
Simple (?) Undelete

• Convar PC Inspector 4
• http//www.pcinspector.de/Sites/file_recovery/down
  load.htm?language1
• Softperfect File Recovery - fast scanner
• http//www.softperfect.com/products/filerecovery/
  (NTFS-FAT, HD, FD, Flash, SD)
• Undelete Plus
• http//www.undelete-plus.com/ (NTFS-FAT, HD, FD,
  Flash, SD,)
• Hirens Boot Disk run inside Windows

13
Portable Apps

• Stand Alone programs which do NOT require
  installation to run.
• Small footprint and clean up after themselves
• Can carry and run from Flash drive (or other
  media)
• Search for Portable App Project or Portable
  Freeware
• http//portableapps.com/
• http//www.portablefreeware.com/

14
Live CD Tools

• Barts PE WinXP http//www.nu2.nu/pebuilder/
• Dell Linux with Open Management Server tools
  (OMSA)
• http//linux.dell.com/files/openmanage-contributio
  ns/omsa-51-live
• Knoppix - http//www.knoppix.org/
• Disk First Aide with Knoppix
• http//www.shockfamily.net/cedric/knoppix/
• Helix custom Knoppix - for forensics and
  recovery
• http//www.e-fense.com/helix/
• Ultimate Boot CD - http//www.ultimatebootcd.com/
  
• SystemRescueCD - http//www.sysresccd.org/
• Hirans Boot CD
• Ubuntu (Live CD use aptget) -
  http//www.ubuntu.com/
• Ubuntu Rescue Remix - http//ubuntu-rescue-remix.o
  rg/

15
Tricks of the Trade

• Floppy Drive try in another machine or best
  option is to try in a MAC or mounting in a nix
  machine
• Hard Drive try the freezer trick
• SD or flash card readers for direct USB
  connection
• USB to ATA/SATA drive universal adapter
• Allows connecting basically any computer or
  laptop hard drive to a computer via the USB port
• Preferred Recovery Approach is to IMAGE the drive
  with some type of BIT Copier and then work on the
  image not the original

16
Corrupted Files

• Microsoft Word
• File Open and choose
• Recover Text from any File

17

• in this case, I would try Testdisk or Parted to
  restore your partition table. I hope her note
  wasn't longer than 512 characters.
• Source - http//xkcd.com/340/

18
Serious Corruption

• TEST Disk recover partitions in most OS File
  Systems (free)
• http//www.cgsecurity.org/wiki/TestDisk_Download
• Found on many Live CDs
• Often Bundled with PhotoRec
• Restoration (free)
• http//www.snapfiles.com/get/restoration.html

19
Sluth Kit

• For those so inclinded
• Forensic Tool
• the Sluth Kit and Autopsy graphical interface
• http//www.sleuthkit.org/index.phpS

20
Commercial

• Gibson Research (Steve Gibson)
• SPINRITE
• http//www.grc.com/spinrite.htm
• Recovery Services

21
Dead Disk Readers

• Hard Drives, CD, DVD, Floppy, Flash
• http//www.s2services.com/diskreaderfreeware.htm
• Tools for all OS systems

22
dd variants

• Linux, Debian, OSX
• Linux/Unix history
• File or Drive/Partition recovery tool
• dd command line
• ddresue easier user interface
• gddrescue gnu project ddrescue

23
Ubuntu Example

• In terminal
• Install gddrescue
• sudo apt-get install gddrescue
• Run this command and BE PATIENT
• sudo ddrescue v /dev/hdc cdr-backup2.iso
  /ddrescue.log
• Or
• sudo ddrescue v /dev/hdd1 /dev/hdc1
  /ddrescue.log
• sudo fsck -C /dev/hdc1

24
dcfldd

• Linux Tool
• dcfldd best on DEBIAN!
• http//dcfldd.sourceforge.net/download

25
Terence Sullivan, Shiloh/Chrisman Schools

• Questions ?
• Presentation
• www.il-edtech.org
• www.shiloh.k12.il.us/presentations

tsulliva_at_comwares.net