User:Laurier Rochon/bbb/hhd forensics

Data carving tools (open-source)

• foremost
• scalpel

http://moddr.net/wiki/doku.php?id=data_carving_workshop (infos) (cheat sheet on there)

• Install foremost
• Check dmesg for info on the newly connected drive (dmesg | tail to get only recent logs)
• Cat /proc/partitions (sdbs' is the one we want - not 'sda', that's our own drive)
• sudo foremost -v -T -o /tmp/report -i /dev/sdb5 (replace sdb5 with drive...)
• install gqview to view broken files

Pipe the contents of HD to mplayer

• cat /proc/partitions (see all your HD partitions)
• HDD to audio : sudo dd if=/dev/sd3 skip=50000 | aplay -
• HDD to video : sudo gst-launch-0.10 filesrc location=/dev/sda3 ! videoparse ! xvimagesink