1

We had a human accident at home and an external hard disk was copied a SD 32gb image card by mistake. The copy should be done to a SD image.

I guess 32gb of the external drive were overwritten, but as far as my knowledge of digital forensics, the most of the information should be there.

Can you please recommend me a good low level scanner to analyse bit-to-bit the information in the whole hard disk to recover pictures and word files (mainly)?

I used to know testdisk, is it valid for it?

I hope you can give us a hand on this.

Kindest regards

3
0

From my personal experience most filecarvers like to make assumptions based on which filesystems they detect. You could create a loop device with 32GB offset just to make sure your scanner/filecarver does not get sidetracked by seemingly valid data you're not interested in (i.e. skip the area you know was overwritten). Note the offset should be 512 Byte or 4K aligned. If you know the exact size of bytes that were overwritten, use that instead.

losetup --find --show --read-only --offset $((32*1000*1000*1000)) /dev/sdx

Then you can use any program of your liking on that loop device. photorec is one, there are others like foremost, scalpel, ... knock yourself out.

If you had partitions / logical volumes that started beyond the 32GB mark you can also try testdisk. If you had a filesystem with redundant metadata you could try to fix that too, but you need to know the original partition offset (e.g. 1 MiB) and some way to locate the metadata backups.

This is best done with overlays https://raid.wiki.kernel.org/index.php/Recovering_a_failed_software_RAID#Making_the_harddisks_read-only_using_an_overlay_file

An overlay allows you to run fsck or some other programs that write on a virtual /dev/mapper/sdxoverlay device, without actually performing those writes on the real disk.

4
  • 2
    It works, it will takes days to scan all the drive, but at least it is on its way. Thanks so much – hertsmael Mar 19 '17 at 18:36
  • Why would you only suggest file carvers like Photorec, Scalpel and Foremost? Those should only be used as a last resort as they won't detect any directory structure nor work with fragmented files. – Andrea Lazzarotto Mar 19 '17 at 20:03
  • The OP was talking about an external hard drive, there is a non-trivial chance that it was formatted as NTFS. The non-overwritten portion of NTFS file systems usually can be reconstructed in terms of directory structure and access of fragmented files. – Andrea Lazzarotto Mar 19 '17 at 20:39
  • Nope, but you could have mentioned that at least in the most likely scenario (NTFS-formatted external hard drive) file carving is definitely not the best option. BTW: you can also answer politely, it's not forbidden by the rules. :) – Andrea Lazzarotto Mar 20 '17 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.