Saerch raw data on disk

  • Thread starter Thread starter Geir
  • Start date Start date
G

Geir

Hi,

I have tried to used file-based recovery solutions to recover a
disappeared, small text file, but to no avail. I'm sure the file data
is there (it has not been overwritten) so I want to search the unused
space of the disk for a text string.

Which tool can I use for this purpose? Most of the tools I have checked
do want filenames to search for....

Hopefully something free if possible ;-)

Thanks a bunch for a quick reply on this

Geir
 
Previously Geir said:
Hi,
Click to expand...
I have tried to used file-based recovery solutions to recover a
disappeared, small text file, but to no avail. I'm sure the file data
is there (it has not been overwritten) so I want to search the unused
space of the disk for a text string.
Click to expand...
Which tool can I use for this purpose? Most of the tools I have checked
do want filenames to search for....
Click to expand...
Hopefully something free if possible ;-)
Click to expand...
Thanks a bunch for a quick reply on this
Click to expand...

Well, you could do something like

cat /dev/<disk> | grep -C 512 "string" | tee result

under Linux. (A Knoppic CD-Linux, if you do not have Linux installed,
e.g.). This will write the search result(s) to file "result" with
512 lines before and after the match. You can then cut the file
"result" down with a text editor. Speed should be close to disk
speed with reasonable hardware.

Arno
 
Arno said:
Well, you could do something like

cat /dev/<disk> | grep -C 512 "string" | tee result

under Linux. (A Knoppic CD-Linux, if you do not have Linux installed,
Click to expand...

Thanks Arno,

This is a windows domain controller. I CAN take it down, but I would
rather ask again if there is a windows disk tool which can do the same
type of searching...

Any win32 compatible clues...?

regards

Geir
 
Thanks Arno,

This is a windows domain controller. I CAN take it down, but I would
rather ask again if there is a windows disk tool which can do the same
type of searching...

Any win32 compatible clues...?
Click to expand...

How about Encase, FTK or Winhex? I think any forensic analysis tool for
Windows would do the trick. But if it's so critically important, you
really shouldn't be using the disk still, or install anything to it.
 
Geir said:
I have tried to used file-based recovery solutions to recover a
disappeared, small text file, but to no avail. I'm sure the file data
is there (it has not been overwritten) so I want to search the unused
space of the disk for a text string.

Which tool can I use for this purpose? Most of the tools I have checked
do want filenames to search for....
Click to expand...
dskprobe in the resource kit will open a volume and search for bytes.
 
Back
Top