restoring windows file system

true_atlantis · 02-23-2006, 02:26 PM

so my buddy got a bunch of his files deleted off his computer (windows xp). im not sure how the drive was formatted, fat32 or nfs. is there any software out there to recover deleted files in these file systems? and how do i tell how the drive was formatted? thanks

pixellany · 02-23-2006, 02:41 PM

Quote:

Originally Posted by true_atlantis

so my buddy got a bunch of his files deleted off his computer (windows xp). im not sure how the drive was formatted, fat32 or nfs. is there any software out there to recover deleted files in these file systems? and how do i tell how the drive was formatted? thanks

Not a Linux question, but......

First, don't attempt to do anything to the disk without a plan of attack. There are lots of data recovery programs and services.
Is the computer bootable into Windows?
What exactly is working and not working?

One option is to boot up from one of the Linux "Live CDs"--eg Knoppix. If you can do this and run "fdisk -l" that will tell us a lot.

But, tell us more details of the current state before trying anything.

true_atlantis · 02-23-2006, 02:49 PM

i just figured i would post this here because if i were to help, i would be using a linux based plan of attack. the machine is bootable, there are just 2 directores deleted from teh d drive that had pictures, videos and music that were delted. the OS is working just fine, im thinking someone broke in because he uses whatever unsecure wireless connection he can have, as well as limewire. maybe a trojan from limewire?

pixellany · 02-23-2006, 02:54 PM

I would start by ghosting (cloning) the drive. Norton Ghost, or the dd command under Linux.
Next decide if you want to learn data recovery or simply send it off to a professional service. (If you are going to try it yourself, search Google (or here) for data recovery tools.

BTW have you checked the trash??

Someone is going to suggest setting up a backup strategy, so I'll refrain......

true_atlantis · 02-23-2006, 03:31 PM

yeah, im pretty sure someone broke into the computer (due to a no adminstrator password) and took his homemade sex videos. haha.