anyone ever recovered deleted photos? (ive got autopsy)

[cobelloy]

hi there, I am using autopsy (sleuth kit GUI) to recover a lot of photos off an ext3 HDD that I deleted by mistake, it installs and runs great with the usr_devx file, however I have a couple of problems now, there is very little info to be found regarding this program, first, my puppy system crashed when I tried to open a huge folder of thumbnails of recovered images, and now I can't boot up KDE, or use wvdial/kppp, (I am using a new pup file for the internet) this is not such a big deal however as the system is still usable enough to run autopsy again, but, I have a folder of thumbnails I can't open, and I don't know how to get the images to a savable place - there are about 3000 image files recovered, but only about 500 or so are photos, and they are all listed as xxx.png when they are .jpg files and of course all the 3000 or so images are in a totally random order with uninformative names (eg. 4eh45dgr6H6F70hdk7djdj.png) has anyone out there ever recovered photos from deletion, or had any experience using autopsy?

[Guest]

well after some head scratching and googling I found another program called foremost

(http://foremost.sourceforge.net/)

which is an extremely simple command line utility.

So here is a how-to in case anyone else needs direction.

1. make an image file of the drive/partition to recover (http://www.murga.org/~puppy/viewtopic.php?t=4867)

**you need to have enough free space on a spare partition/drive to save the image file

2. get the usr_devx.sfs file from the puppy site (http://www.puppylinux.org/user/downloads.php?cat_id=12) and copy it to the same directory that your pupxxx file is in then reboot

3. download foremost from http://foremost.sourceforge.net/

4. open a terminal in the folder that formost was saved to, then run:

tar xvzf foremostx.x.tar.gz
(where x.x is the version number you have - duh...)

5. read the readme file in the expanded folder and follow the instructions for installing and running the utility

an online man page can be found here:
http://foremost.sourceforge.net/foremost.html

6. as an example - I ran this command:

foremost -t jpeg -i /mnt/hda3/diskimg.raw -o /mnt/hda3/recovered

that specifies jpeg files only, from diskimg.raw on hda3 recovered to the folder
(automatically created) /mnt/hda3/recovered

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

I had originally started trying to use sleuthkit/autopsy since these are powerful data recovery tools - but they are a bit complicated for people with little expertise like me

although, here's an idea for someone clever out there - "recovery puppy" it could include sleuthkit/autopsy, foremost, fatback... etc...

an all-in -one live data recovery system

[cobelloy]

that was me, I forgot to log in - D'OH

[GuestToo]

there is a fatback package on my dotpups page ... fatback may not work very well

[Lobster]

well after some head scratching and googling I found another program called foremost

(http://foremost.sourceforge.net/)

Very interesting
I am not going to put this info on the wiki
because someone (?)
will turn all this into a dotpup?