Can Scalpel retrieve files from a Windows XP box?

Alaskaman66 · 07-02-2017, 01:01 AM

This is a rather strange problem. My wife's computer, an HP running Windows XP, was accidentally restored back to original state (F10) after we had used it for several years. Needless to say, lots of applications and date went away. Can I create a boot USB drive using Linux and retrieve files by type using scalpel? The computer has not been used since the event so hopefully things haven't been completely overwritten. Thanks. My laptop has a partition with a distribution of Fedora/RedHat.

syg00 · 07-02-2017, 02:04 AM

Data carvers generally don't care - they go looking for fingerprints on the data itself. You might be better off looking at photorec - and no, it's not limited to recovering only photos.
Make sure you have another (different) disk to recover onto.

Alaskaman66 · 07-09-2017, 03:38 PM

I will look at photorec software also. I have created a boot USB for the HP Pavillion computer, but have not had time to try it out. However, your reply does answer my question. I just have to go through the hoops to get it done.
Thanks

jamison20000e · 07-09-2017, 05:29 PM

Hi.

I've not used forensics tools in Linux for a long time now, last for my dad where as I just make backups every which way from Wednesday...

If those don't work found this https://www.gnu.org/software/ddrescue/ddrescue.html
searching: photos forensics Linux

good luck
and have fun!