Member Avatar for SergioQ

Am not looking for a specific deleted file. Let me put it another way, and maybe someone can help me in another way....

Am looking for lost info. Files lopng deleted etc. But since this machine has bearely been used, it's posssible the data is sitting in an a now UNused part of the HD. Unused, but still having old data on it.

I am a C programmer. Maybe I should look to see hot to start the pointer at Sector zero...then scan till the last sector? Looking for my matches?

What do you think?

Thanks for all the input so far. Thiss is a great forum(s)

Sergio

  • 3 Contributors
  • 2 Replies
  • 96 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by YourGamerMom

Recommended Answers

All 2 Replies

Member Avatar for L7Sqr

If the data you were looking for has been overwritten then you are pretty much out of luck unless you have forensics tools. If not, you may try to mount the drive on an external machine and iterate through the filesystem structure. If the file was just marked for deletion but not overwritten it is possible that the data is still intact.
This is all very sensitive to the OS, hardware, filesystem implementation and other details.

Member Avatar for YourGamerMom

On windows if the file has not been overwritten it usually has a '~' in front of the name to tell windows that it can be overwritten. This may be helpful if you choose to mount the drive on another machine.

Edited by YourGamerMom because: Spelling Error
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.