1
vote
1answer
29 views

How are files or chunks delimited on disk?

I'm trying to recover some lost files by grep-scanning a hard disk. (The OS is Darwin 11.4.2. The file system is HFS.) How can I determine where a file (or contiguous chunk thereof) begins and ends ...
0
votes
1answer
31 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
1
vote
0answers
38 views

Retrieve spanned archive from raw disk image

When I open the image in a hex editor, there is the header of a PK spanned archive (50 4B 07 08), then 4 more zip files following (50 4B). When copying the values and saving as a zip file, the ...
2
votes
1answer
128 views

Finding modified date and time of file from recovered disk image

Some jpeg files have been recovered from an image file of a floppy disk. Is there a way to get the modified, created and last accessed date and times of those files recovered, i.e. the time and date ...
3
votes
0answers
255 views

Foremost file naming - Recovery of file names from inodes

I'm hoping this is not a stupid question. (apologies if it is) I have been asked to recover some files from a corrupt Linux partition. The partition data is shot to pieces but i have been able to ...
3
votes
3answers
581 views

How to make data-recovery very-very hard or impossible for Unix -computer before reselling?

I resell my Thinkpad and I want to make sure its old content in the harddrive is not readable. The Thinkpad has now Debian -installed but I sell it as-is so no OS needed. How can I can rewrite the ...