Recovering Data from Windows systems by using Linux

DavidGP · Nov 22, 2007

I know many of the members here will know about using Linux to recover data from a crashed Windows PC, but maybe some useful other tips here....

NOTE:

This paper is written with the assumption that the reader is comfortable on the Linux command line, and can perform basic file operations
Click to expand...

Abstract:
We have all run into cases where Windows fails to load for one reason or another. The problem may be hardware or a software failure, and the problem may seem to be irrecoverable. Yet often Linux can be used to help recover data that otherwise might be lost. Another application of using Linux recovery is in the creation of disk images for post-mortem analysis of security breaches. While such images are not created according to forensics standards (which usually requires special hardware) and would not be likely to be of help in legal cases, they are helpful in internal reviews following such incidents.

Note: This paper represents testing and documentation in a lab environment. User Account Control (UAC) is an essential security component to Windows and Microsoft does not recommend turning off UAC in production environments.
Click to expand...

http://port25.technet.com/archive/2...data-from-windows-systems-by-using-linux.aspx

Adrynalyne · Nov 22, 2007

Nice, a bit dated though, so I see some pretty important errors...due to the age of the kernel mentioned, not because its from MS

I'll highlight them later when I have more time.

First one I saw is that all drives are listed with /dev/sd* now, since the 2.6 kernel, which has been for the last year or so.

DavidGP · Nov 22, 2007

Woth posting back to the Port25 team

Adrynalyne · Nov 22, 2007

Ok, I'll add another.

Not all Linux distributions come with NTFS drivers even though read-only drivers are a part of the current Linux source code. Although Knoppix does have such support, Fedora does not. Often you can locate drivers on third party web sites. In general, recompiling the Linux kernel is more trouble than you want to go through for something like this. If you can't find the drivers, use Knoppix.
Click to expand...

This is untrue, now. Most well known distros have full read/write ntfs support and while writing to ntfs is still considered...somewhat unsafe, it is much, much, much better than it used to be, especially with the addition of the ntfs-3g driver.

Adrynalyne · Nov 22, 2007

Halo said: ↑

Woth posting back to the Port25 team
Click to expand...

You offering?

ItsWendy · Nov 22, 2007

Man, I could use this! Do you realize the luxury of having a Live! CD where you could transfer files off the dead machine with a working network! This would be worth money, at least to me. I would even prepare in advance, and make a custome Live! CD for each machine, just in case.

Adrynalyne · Nov 22, 2007

I lost my data using Linux trying to save a partition

Of course, I took it upon myself and got in over my head.

But yes, Linux has many uses, not just as an OS. It can be used to power just about anything.

For example, Gparted, available here, runs on top of Gentoo, but just enough to get it going to use. Cool, eh?

TimW · Nov 22, 2007

Maybe we need a sticky on creating a LiveCD ...for just those purposes ..

ItsWendy · Nov 23, 2007

The neat thing is, you can set it up BEFORE you need it. Given how many times people answer no to "Did you back up your data?" it may be a lost cause, but I would do it.

Log in or Sign up

Recovering Data from Windows systems by using Linux

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

Adrynalyne Guest

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

Adrynalyne Guest

Adrynalyne Guest

ItsWendy MajorGeek

Adrynalyne Guest

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ItsWendy MajorGeek