my files have been deleted by the outlookrem.exe
better nown as W32.Nopir.C . worm
it deletes several file eg mp3 avi mpg rar etc
i use ontrack data recovery and recover my files and Active@ UNDELETE.and some other tools
i can see the correct filename and file size and file type
some files are fully recoverable and some are marked as crosslinked and cannot be recoverd as working files
On earlier file systems this was accomplished with a sector editor used to modify the FAT.
The files that are linked incorrectly are partially recoverable up to the last cluster before the error link. The files that are correctly linked are fully recoverable but it would be best that you copy them somewhere else to insure that everything is identified and linked correctly.
Ed Fair
Give the wrong symptoms, get the wrong solutions.
the definition of carving is (also called salvaging):
to carve is to locate a deleted file either in its enitrety or through fragments by searching for any occurance of the known file's header information.
the answer to your questions & more can be found in the book Guide to Computer Forensics and Investigations.
it is now in a 2nd Edition, but the original is the one i have and gives a wealth of information; including a CD from Digital Intelligence that includes DriveSpy, which can be used to carve data from corrupt files.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.