Saerch raw data on disk

G

Geir

Hi,

I have tried to used file-based recovery solutions to recover a
disappeared, small text file, but to no avail. I'm sure the file data
is there (it has not been overwritten) so I want to search the unused
space of the disk for a text string.

Which tool can I use for this purpose? Most of the tools I have checked
do want filenames to search for....

Hopefully something free if possible ;-)

Thanks a bunch for a quick reply on this

Geir
 
A

Arno Wagner

Previously Geir said:
I have tried to used file-based recovery solutions to recover a
disappeared, small text file, but to no avail. I'm sure the file data
is there (it has not been overwritten) so I want to search the unused
space of the disk for a text string.
Which tool can I use for this purpose? Most of the tools I have checked
do want filenames to search for....
Hopefully something free if possible ;-)
Thanks a bunch for a quick reply on this

Well, you could do something like

cat /dev/<disk> | grep -C 512 "string" | tee result

under Linux. (A Knoppic CD-Linux, if you do not have Linux installed,
e.g.). This will write the search result(s) to file "result" with
512 lines before and after the match. You can then cut the file
"result" down with a text editor. Speed should be close to disk
speed with reasonable hardware.

Arno
 
G

Geir

Arno said:
Well, you could do something like

cat /dev/<disk> | grep -C 512 "string" | tee result

under Linux. (A Knoppic CD-Linux, if you do not have Linux installed,

Thanks Arno,

This is a windows domain controller. I CAN take it down, but I would
rather ask again if there is a windows disk tool which can do the same
type of searching...

Any win32 compatible clues...?

regards

Geir
 
M

Michael Cecil

Thanks Arno,

This is a windows domain controller. I CAN take it down, but I would
rather ask again if there is a windows disk tool which can do the same
type of searching...

Any win32 compatible clues...?

How about Encase, FTK or Winhex? I think any forensic analysis tool for
Windows would do the trick. But if it's so critically important, you
really shouldn't be using the disk still, or install anything to it.
 
E

Eric Gisin

Geir said:
I have tried to used file-based recovery solutions to recover a
disappeared, small text file, but to no avail. I'm sure the file data
is there (it has not been overwritten) so I want to search the unused
space of the disk for a text string.

Which tool can I use for this purpose? Most of the tools I have checked
do want filenames to search for....
dskprobe in the resource kit will open a volume and search for bytes.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top