Recover Data Like a Forensics Expert Using an Ubuntu Live CD [Step By Step]

By The How-To Geek, LifehackerApril 27, 2010 at 02:30PM

Recover Data Like a Forensics Expert Using an Ubuntu Live CDPlenty of utilities can recover deleted files, but what if you can’t boot your computer, or the whole drive has been formatted? Here’s how to dig deep and recover the most elusive deleted files, or even whole partitions.

We’ve shown you simple ways to recover accidentally deleted files, even a simple method that can be done from an Ubuntu Live CD, but for hard disks that have been heavily corrupted, those methods aren’t going to cut it. In this article, we’ll examine four tools that can recover data from the most messed up hard drives, regardless of whether they were formatted for a Windows, Linux, or Mac computer, or even if the partition table is wiped out entirely.

Note: These tools cannot recover data that has been overwritten on a hard disk. Whether a deleted file has been overwritten depends on many factors – the quicker you realize that you want to recover a file, the more likely you will be able to do so.

Our setup

To show these tools, we’ve set up a small 1 GB hard drive, with half of the space partitioned as ext2, a file system used in Linux, and half the space partitioned as FAT32, a file system used in older Windows systems. We stored ten random pictures on each hard drive.

sshot-1

We then wiped the partition table from the hard drive by deleting the partitions in GParted.

sshot-2

Is our data lost forever?

Installing the tools

All of the tools we’re going to use are in Ubuntu’s universe repository.

To enable the repository, open Synaptic Package Manager by clicking on System in the top-left, then Administration > Synaptic Package Manager.

Click on Settings > Repositories and add a check in the box labelled “Community-maintained Open Source software (universe)”.

sshot-3

Click Close, and then in the main Synaptic Package Manager window, click the Reload button. Once the package list has reloaded, and the search index rebuilt, search for and mark for installation one or all of the following packages: testdisk, foremost, and scalpel.

Testdisk includes TestDisk, which can recover lost partitions and repair boot sectors, and PhotoRec, which can recover many different types of files from tons of different file systems.

sshot-4

Foremost, originally developed by the US Air Force Office of Special Investigations, recovers files based on their headers and other internal structures. Foremost operates on hard drives or drive image files generated by various tools.

sshot-6

Finally, scalpel performs the same functions as foremost, but is focused on enhanced performance and lower memory usage. Scalpel may run better if you have an older machine with less RAM.

sshot-5

Recover hard drive partitions

If you can’t mount your hard drive, then its partition table might be corrupted. Before you start trying to recover your important files, it may be possible to recover one or more partitions on your drive, recovering all of your files with one step.

Testdisk is the tool for the job. Start it by opening a terminal (Applications > Accessories > Terminal) and typing in:

sudo testdisk

sshot-8

If you’d like, you can create a log file, though it won’t affect how much data you recover. Once you make your choice, you’re greeted with a list of the storage media on your machine. You should be able to identify the hard drive you want to recover partitions from by its size and label.

sshot-9

TestDisk asks you to select the type of partition table to search for. In most cases (ext2/3, NTFS, FAT32, etc.) you should select Intel and press Enter.

sshot-10

Highlight Analyse and press Enter.

sshot-11

In our case, our small hard drive has previously been formatted as NTFS. Amazingly, TestDisk finds this partition, though it is unable to recover it.

sshot-12

It also finds the two partitions we just deleted. We are able to change their attributes, or add more partitions, but we’ll just recover them by pressing Enter.

sshot-13

If TestDisk hasn’t found all of your partitions, you can try doing a deeper search by selecting that option with the left and right arrow keys. We only had these two partitions, so we’ll recover them by selecting Write and pressing Enter.

sshot-14

Testdisk informs us that we will have to reboot.

sshot-15

Note: If your Ubuntu Live CD is not persistent, then when you reboot you will have to reinstall any tools that you installed earlier.

After restarting, both of our partitions are back to their original states, pictures and all.

sshot-16

Recover files of certain types

For the following examples, we deleted the 10 pictures from both partitions and then reformatted them.

PhotoRec

Of the three tools we’ll show, PhotoRec is the most user-friendly, despite being a console-based utility. To start recovering files, open a terminal (Applications > Accessories > Terminal) and type in:

sudo photorec

To begin, you are asked to select a storage device to search. You should be able to identify the right device by its size and label. Select the right device, and then hit Enter.

sshot-17

PhotoRec asks you to select the type of partition to search. In most cases (ext2/3, NTFS, FAT, etc.) you should select Intel and press Enter.

sshot-18

You are given a list of the partitions on your selected hard drive. If you want to recover all of the files on a partition, then select Search and hit Enter.

However, this process can be very slow, and in our case we only want to search for picture files, so instead we use the right arrow key to select File Opt and press Enter.

sshot-19

PhotoRec can recover many different types of files, and deselecting each one would take a long time. Instead, we press “s” to clear all of the selections, and then find the appropriate file types – jpg, gif, and png – and select them by pressing the right arrow key.

sshot-20

Once we’ve selected these three, we press “b” to save these selections.

sshot-21

Press Enter to return to the list of hard drive partitions. We want to search both of our partitions, so we highlight “No partition” and “Search” and then press Enter.

sshot-22

PhotoRec prompts for a location to store the recovered files. If you have a different healthy hard drive, then we recommend storing the recovered files there. Since we’re not recovering very much, we’ll store it on the Ubuntu Live CD’s desktop.

Note: Do not recover files to the hard drive you’re recovering from.

sshot-23

PhotoRec is able to recover the 20 pictures from the partitions on our hard drive!

sshot-24

A quick look in the recup_dir.1 directory that it creates confirms that PhotoRec has recovered all of our pictures, save for the file names.

sshot-25

Foremost

Foremost is a command-line program with no interactive interface like PhotoRec, but offers a number of command-line options to get as much data out of your had drive as possible.

For a full list of options that can be tweaked via the command line, open up a terminal (Applications > Accessories > Terminal) and type in:

foremost –h

In our case, the command line options that we are going to use are:

  • -t, a comma-separated list of types of files to search for. In our case, this is “jpeg,png,gif”.
  • -v, enabling verbose-mode, giving us more information about what foremost is doing.
  • -o, the output folder to store recovered files in. In our case, we created a directory called “foremost” on the desktop.
  • -i, the input that will be searched for files. This can be a disk image in several different formats; however, we will use a hard disk, /dev/sda.

Our foremost invocation is:

sudo foremost –t jpeg,png,gif –o foremost –v –i /dev/sda

Your invocation will differ depending on what you’re searching for and where you’re searching for it.

sshot-26

Foremost is able to recover 17 of the 20 files stored on the hard drive.

sshot-27

Looking at the files, we can confirm that these files were recovered relatively well, though we can see some errors in the thumbnail for 00622449.jpg.

sshot-28

Part of this may be due to the ext2 filesystem. Foremost recommends using the –d command-line option for Linux file systems like ext2.

We’ll run foremost again, adding the –d command-line option to our foremost invocation:

sudo foremost –t jpeg,png,gif –d –o foremost –v –i /dev/sda

sshot-29

This time, foremost is able to recover all 20 images!

sshot-30

A final look at the pictures reveals that the pictures were recovered with no problems.

sshot-31

Scalpel

Scalpel is another powerful program that, like Foremost, is heavily configurable. Unlike Foremost, Scalpel requires you to edit a configuration file before attempting any data recovery.

Any text editor will do, but we’ll use gedit to change the configuration file. In a terminal window (Applications > Accessories > Terminal), type in:

sudo gedit /etc/scalpel/scalpel.conf

sshot-32

scalpel.conf contains information about a number of different file types. Scroll through this file and uncomment lines that start with a file type that you want to recover (i.e. remove the “#” character at the start of those lines).

sshot-33

Save the file and close it. Return to the terminal window.

Scalpel also has a ton of command-line options that can help you search quickly and effectively; however, we’ll just define the input device (/dev/sda) and the output folder (a folder called “scalpel” that we created on the desktop).

Our invocation is:

sudo scalpel /dev/sda –o scalpel

sshot-34

Scalpel is able to recover 18 of our 20 files.

sshot-35

A quick look at the files scalpel recovered reveals that most of our files were recovered successfully, though there were some problems (e.g. 00000012.jpg).

sshot-36

Conclusion

In our quick toy example, TestDisk was able to recover two deleted partitions, and PhotoRec and Foremost were able to recover all 20 deleted images. Scalpel recovered most of the files, but it’s very likely that playing with the command-line options for scalpel would have enabled us to recover all 20 images.

These tools are lifesavers when something goes wrong with your hard drive. If your data is on the hard drive somewhere, then one of these tools will track it down!

Laptop-Reliability Study Highlights the Most Sturdy Laptop Makers [Buying Guide]

By Adam Pash, LifehackerApril 26, 2010 at 02:30PM

Laptop-Reliability Study Highlights the Most Sturdy Laptop MakersThere’s nothing worse than buying new gear that malfunctions shortly after you purchase it. If you’re in the market for a new laptop, check out warranty-provider SquareTrade’s detailed laptop-reliability report to find the most dependable hardware.

The warranty company released a research paper late last year analyzing failure rates for over 30,000 laptops covered by their warranties. The report is full of good information worth considering before your next big purchase. The highlights of the study:

  • Looking at the first 3 years of ownership, 31% of laptop owners reported a failure to SquareTrade. Two-thirds of this failure (20.4%) came from hardware malfunctions, and one-third (10.6%) was reported as accidental damage.
  • Netbooks are projected to have a 20% higher failure rate from hardware malfunctions than more expensive laptop computers.
  • ASUS and Toshiba were the most reliable manufacturers, with fewer than 16% having a hardware malfunction over 3 years.

It’s interesting to note that, on a whole, netbooks are a lot more failure prone than laptops. It’s also perhaps a little surprising that a company like Apple, known for its hardware, still ends up a percentage point or two worse off than companies like ASUS and Toshiba when it comes to laptop malfunction rates.

Got a laptop brand you trust above all others for its reliability? Sing its praises in the comments. Thanks leonardtj!

Laptop Reliability Report [SquareTrade via CNET]

BatchGeo Maps a Spreadsheet Full of Addresses to a Single Google Map [Maps]

By A3sthetix, LifehackerApril 26, 2010 at 01:00PM

Got a spreadsheet full of contacts and addresses you’d like to map out without spending hours manually copying and pasting between your spreadsheet and a mapping application? Reader A3sthetix points us toward BatchGeo, a smart spreadsheet-to-Google-Map conversion tool.

I was faced with the daunting task of mapping over a hundred addresses to a map today. In researching solutions, I came across a Google Maps mashup called BatchGeo, which made the whole task unbelievably simple. All you need to do is paste a table or spreadsheet into the webapp and it does the rest, including validating columns and addresses. The auto-generated map can then be saved for later use.

BatchGeo could also be used for apartment hunters that want to visualize a spreadsheet of potential dwellings. I’m currently using it for creating a store locater and looking at package shipments to correlate common destinations (the long-term goal is to determine where a distribution center might be useful.)

As you can see in the video, the end product even retains information from other columns in your original spreadsheet (like name and telephone number, for example), which is particularly handy.

A guide to protecting your information on the New Facebook

By Jay Hathaway, Download SquadApril 26, 2010 at 12:00PM

Filed under: , , ,

By now, you’ve probably heard that Facebook has made some big changes that affect your privacy. However, you might not know what they are. So far, the changes have been explained in the language of the people that they benefit: companies and app developers. What about us, the end users? Here’s a handy collection of the best tips that we could find for protecting your privacy on Facebook’s wild new frontier.Obviously, the best way to keep your information private on Facebook is to not have a Facebook page. You can deactivate your account using the link at the bottom of the account settings page, which hides your info and gives you the option to reactivate later and pick up where you left off. If you’re looking for a full, permanent, once-and-for-all Delete Account link, you can find it in Facebook’s help center.


If you’re not going to delete your account, you should (at a minimum) pop open your Application Settings and delete any Facebook apps that you aren’t using. Under new Facebook rules, apps can hold onto your info as long as they like (as opposed to the old limit of 24 hours). That makes using apps more convenient (you don’t have to authorize them repeatedly), but it also means that you’re trusting them a lot more. If you don’t trust or don’t use an app, just hit that X and disconnect it from your account.

Another new Facebook feature that you have to be careful of is that all of your interests and favorites (and even your hometown) will be linked to Facebook pages now. These will be visible to search engines and anyone who finds your page. To get around this, you can delete that info altogether, or move it to the freeform “About Me” box.

There’s also a sneaky new preference called Instant Personalization that you’ve been automatically opted into (gee, thanks Facebook!) This is that “Facebook automatically shares ALL of your data with its special partner sites” feature I wrote about last month, and now it’s here. So far, the partners are Yelp, Microsoft’s Docs.com, and Pandora. Go ahead and find Instant Personalization in preferences under Applications and Web sites and uncheck it.

Facebook warns you that even unchecking Instant Personalization won’t stop your friends from automatically sharing your info to personalize their experiences on the partner sites. Friends who don’t care about privacy are a major leak on Facebook, so you’ll also want to uncheck every single box under the “What your friends can share about you” section of the preferences. It’s under Applications and Web sites.

Of course, it doesn’t help to keep your friends from sharing your info if you’re sharing it yourself. To make sure you’re not, go to Profile Information, and make sure everything is set to Only Friends. It’s a tedious process, but it’s highly recommended.

Remember, the only way to guarantee that Facebook won’t share, sell, or expose your information is to not put that information on Facebook at all. Of course, Facebook is harder and harder to avoid as it becomes a more useful, more essential part of the Web. It’s important to take basics steps in order to make sure you’re only sharing what you want to.

A guide to protecting your information on the New Facebook originally appeared on Download Squad on Mon, 26 Apr 2010 11:00:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments

Add to digg
Add to del.icio.us
Add to Google
Add to StumbleUpon
Add to Facebook
Add to Reddit
Add to Technorati



FacebookMicrosoftPrivacyYelpPandora Radio

Use MP3 Skype Recorder to defend yourself against faceless corporations

By Erez Zukerman, Download SquadApril 26, 2010 at 10:00AM

Filed under: , ,

MP3 Skype Recorder

“I want you to know this call is being recorded.” Those were the first words I told the service rep who picked up the phone at my ISP’s large call center (012.net, to any Israelis who may be reading this). Having tried resolving a basic problem with the service for two months now, I was beyond frustrated; I was desperate, at my wits’ end. My requests were repeatedly shot down, ignored, altered, or simply brushed off.

Every time I called the ISP I had to describe my problem anew, to a new representative; and the most frustrating thing was that I could not tell them, “but the previous guy told me that …”, because I had no way to prove it!

MP3 Skype Recorder completely changed things for me. Having started the conversation with those magic words (and making sure to get the rep’s name), things went amazingly smoothly. Within 13 minutes, my issue was resolved, and I was even recompensed for some of the trouble I went through.

MP3 Skype Recorder is freeware, and does not impose any limits on the duration of the call. The MP3s are low-quality by default, which is fine for a phone call; the entire 13-minute calls takes up only 2.5MB of disk space. The interface is sparse, but it definitely does work. Lee covered the program a while back, but versions released since offer better compression, fix sound quality problems (clipping and distortion), and are compatible with Skype 2.4. Oh, and the name has been changed.

Use MP3 Skype Recorder to defend yourself against faceless corporations originally appeared on Download Squad on Mon, 26 Apr 2010 09:00:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments

Add to digg
Add to del.icio.us
Add to Google
Add to StumbleUpon
Add to Facebook
Add to Reddit
Add to Technorati



SkypeVoice over Internet ProtocolDownload SquadMP3Business

Entrustet Secures Your Accounts After Death with Legal Backing [Deathhacker]

By Kevin Purdy, LifehackerApril 26, 2010 at 06:00AM

Entrustet Secures Your Accounts After Death with Legal BackingThe fate of your house, car, and Action Comics collection after your death can be planned for in legal documents. Your Gmail and Facebook accounts? That’s a bit murky. New legacy service Entrustet aims to help create legally sound post-mortem password vaults.

Entrustet offers a free account that lets you set up three unlimited password-protected accounts to be transferred over to a trust person upon your passing. How does it know when you’re gone? You assign a trusted person to be your Digital Executor, who will notify Entrustet and then provide a death certificate scan to activate the password conveyance upon your death. You can also assign your estate attorney to execute your Entrustet transfer upon your death, and the site offers up a few attorneys officially on board with Entrustet—though we imagine any savvy attorney can be conscripted for the duty. Additional security and ease-of-use features (for the executor and recipients, at least) are included with paid plans.

It’s a bit like previously mentioned Legacy Locker—it’s a smart idea, but those interested enough in their post-mortem web accounts likely will have their own scheme set up, rather than pay for Entrustet’s extra accounts and features. Still, there are other features to come, like an Account Incinerator, that you might find convenient when you’re not exactly in a position to fine-tune things.

Entrustet is free to sign up for and try out with a few accounts. Tell us the (general) details of your own plans for your online life after your passing in the comments.

Mazda i-stop engine-idling-stop system wins another major award

By (author unknown), Gizmag Emerging Technology MagazineApril 26, 2010 at 01:28AM

Mazda i-stop engine-idling-stop system wins another major award

Mazda’s innovative i-stop engine-idling-stop system has won yet another award, this time at the lchimura Industrial Awards. While idling stop systems are now becoming commonplace due to the approximate 10% fuel savings they offer, conventional engine stop systems rely on a motor to restart the engine, whereas Mazda’s i-stop restarts the engine through combustion: fuel is directly injected into a cylinder while the engine is stopped and ignited to generate downward piston force. Mazda’s use of principles unique to the direct injection spark ignition (DISI) engine restarts the engine in just 0.35 seconds, about half the time of most other competing systems, while minimizing noise and vibration and drain on the batteries…
Continue Reading Mazda i-stop engine-idling-stop system wins another major award

Tags: ,
,
,
,

Related Articles: