Does imaging HDD capture deleted files too?


cyber101

New Member
Sep 21, 2016
84
0
#3
What methods are you referencing?

<r><QUOTE author="cybercop"><s>
cybercop said:
</s>Depends on the method used to image it.<e>
</e></QUOTE>
Hi <br/>
What type of methods are you referring to? Not all imaging<br/>
software companies use the same method to image?<br/>
<br/>
Thanks in advance.</r>
 

cyber101

New Member
Sep 21, 2016
84
0
#5
logical copy vs bit for bit

<r><QUOTE author="PreferredUser"><s>
PreferredUser said:
</s>Are you making a logical copy or a bit-for-bit image?<e>
</e></QUOTE>

Hi<br/>
Not sure what the difference between the two are? Could you<br/>
kindly explain pls? When is it appropriate to use either method?<br/>
<br/>
Thanks</r>
 

cyber101

New Member
Sep 21, 2016
84
0
#8
Logical copy required

<r><QUOTE author="PreferredUser"><s>
PreferredUser said:
</s>"<URL url="http://lmgtfy.com/?q=logical+copy">http://lmgtfy.com/?q=logical+copy</URL>"<e>
</e></QUOTE>
A logical copy as I need the files on the USB before I got <br/>
the error message. Bit-to bit is not required as I'm not after access to deleted files on the USB. <br/>
<br/>
Note: there is something about the USB now being in RAW format even though it wasn't before the error. Does this mean the files are deleted per se or sitting there under RAW format?<br/>
<br/>
What would happen if I made a copy in both methods?<br/>
What's the next step from here? Thanks.</r>
 

cybercop

Administrator
Oct 31, 2005
1,660
0
#9
So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.
 

cybercop

Administrator
Oct 31, 2005
1,660
0
#10
So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.
 

cyber101

New Member
Sep 21, 2016
84
0
#11
GetBackData has RAW format option?

<r><QUOTE author="cybercop"><s>
cybercop said:
</s>So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.<e>
</e></QUOTE>

I intend to make an image of the USB stick which is in RAW format; reading the manual from GetBackData says:<br/>
Start up GetDataBack for either FAT or NTFS, they both create images exactly the same way. If your drive is NTFS you can use GetDataBack for FAT to create the image and vice versa.<br/>
source: "<URL url="https://www.runtime.org/gdbimage.htm">https://www.runtime.org/gdbimage.htm</URL>"<br/>
<br/>
The USB stick I want to image is in RAW format at the moment but was something else before. It morphed into RAW format by its own doing. Should I proceed with making an image if RAW is not able in GetBackData?<br/>
<br/>
Thanks in advance.<br/>
<br/>
<br/>
Moderator Note: Direct links are not allowed.</r>
 
Dec 31, 2006
3,405
0
#12
It morphed all on its own? Interesting.

There are many articles on recovery from RAW:

"http://www.easeus.com/resource/raw-usb-drive-recovery.htm"
"http://html5.litten.com/updated-how-to-fix-external-disk-drive-suddenly-became-raw/"
"http://superuser.com/questions/422662/how-to-fix-corrupted-filesystem-shows-as-raw-in-usb-device"

Did you use a search engine to research this problem? If you would have provided a complete description of your problem in your original post you would likely have gotten a better answer sooner. Just saying.
 

cyber101

New Member
Sep 21, 2016
84
0
#13
PreferredUser said:
It morphed all on its own? Interesting.

There are many articles on recovery from RAW:

"http://www.easeus.com/resource/raw-usb-drive-recovery.htm"
"http://html5.litten.com/updated-how-to-fix-external-disk-drive-suddenly-became-raw/"
"http://superuser.com/questions/422662/how-to-fix-corrupted-filesystem-shows-as-raw-in-usb-device"

Did you use a search engine to research this problem? If you would have provided a complete description of your problem in your original post you would likely have gotten a better answer sooner. Just saying.
I did some research but your links seem better; I will follow that up.
Thank you for suggestions and help.
 

cyber101

New Member
Sep 21, 2016
84
0
#14
Do I need to pay of GetBackData in order to complete recover

<r><QUOTE author="cybercop"><s>
cybercop said:
</s>So this and your other post are both for the same situation. If the format isnt recognized and all you need is to get the data back, then you don't need forensics. You need data recovery tools such as GetDataBack for windows or even photorec on linux.<e>
</e></QUOTE>
Once GetDataBack recovers the files will it ask for me to buy it in order to finalize the transfer of the recovered files to another drive? If so, then is there a another program that is 100% free? Thanks in advance.</r>
 

cyber101

New Member
Sep 21, 2016
84
0
#15
image clone first before recovery?

<t>Should I make an image (clone) of the USB stick first before using an Recovery Software Tools on it? If so, which free open source imaging cloning product do you suggest?</t>
 

SgtJackie

New Member
Nov 30, 2015
58
0
#17
Re: image clone first before recovery?

<r><QUOTE author="cyber101"><s>
cyber101 said:
</s>Should I make an image (clone) of the USB stick first before using an Recovery Software Tools on it? If so, which free open source imaging cloning product do you suggest?<e>
</e></QUOTE>
FTK Imager works well and there are free versions.</r>
 

cyber101

New Member
Sep 21, 2016
84
0
#18
which format the USB stick was in originally?

<r><QUOTE author="SgtJackie"><s>
SgtJackie said:
</s><QUOTE author="cyber101"><s>
cyber101 said:
</s>Should I make an image (clone) of the USB stick first before using an Recovery Software Tools on it? If so, which free open source imaging cloning product do you suggest?<e>
</e></QUOTE>
FTK Imager works well and there are free versions.<e>
</e></QUOTE>
Are you 100% certain that FTK imager will make an image of a USB stick that is in Raw format (not FAT or NTFS)? Cause that's what I'm trying to do for now before I convert the USB from RAW to FAT. Actually I'm not sure what format it was in originally; if it was in FAT or NTFS. <br/>
<br/>
Q: How do I find out which format the USB stick was in originally?; does it matter?</r>
 

cyber101

New Member
Sep 21, 2016
84
0
#19
Re: image clone first before recovery?

<r><QUOTE author="SgtJackie"><s>
SgtJackie said:
</s><QUOTE author="cyber101"><s>
cyber101 said:
</s>Should I make an image (clone) of the USB stick first before using an Recovery Software Tools on it? If so, which free open source imaging cloning product do you suggest?<e>
</e></QUOTE>
FTK Imager works well and there are free versions.<e>
</e></QUOTE>
Is it normal fo rthe USB stick to flash when FTK imager is taking the image. I had no idea it took ages to complete the imaging process; approaching 6 hour mark as of writing.</r>
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu