Re: [sleuthkit-users] will sleuthkit recover files from a corrupt ntfs?

[farmer d. <far...@ya...>]

--- On Sun, 1/31/10, Geoffrey <li...@se...> wrote:
> Looking for Microsoft Office docs and photos.


Hi Joshua,

As with most things Linux you'll get different recommendations  :)   Keep in line with that, I'd give 'foremost' a whirl.  Unless the rock I've been living under has completely blocked updates from reaching me, foremost has been updated more recently than scalpel, most recently adding support for MS Office 2007 files.

Also, depending upon the NTFS file system state you _may_ make some headway using scrounge-ntfs.

Cheers!

farmerdude

www.onlineforensictraining.com

www.forensicbootcd.com