Advanced Data-Carving Applications

TestDisk and PhotoRec are only the tip of the iceberg, but more advanced programs are typically intended for full-blown forensics work and not casual use.

The granddaddy of all data-carving programs is probably Foremost, originally developed for the United States Air Force's Office of Special Investigations. It's now been released into the public domain, so it can be used pretty much anywhere and even re-used in other programs. Note that binaries are not readily available for Foremost; you generally need to compile the program from source to make it workable. Some Linux distributions (like Ubuntu Feisty) have a precompiled version of Foremost available in the software repository, which makes it easy to download and use.

In the same vein is Scalpel, a rewrite of the 0.69 version of Foremost -- it's faster, makes better use of memory, and has a number of other handy functions for more advanced file retrieval. It also is not readily available in a binary edition, and must be compiled from source.

Output from The Sleuth Kit's fsstat tool details information about a file system image dumped from a damaged drive.
(click for image gallery)

One extremely powerful collection of tools that can be run on a variety of platforms (*NIX, BSD, and Windows using the CYGWIN library) is the Sleuth Kit. Like Foremost and Scalpel, it can search for deleted files based on hashes or signatures, but it also sports a tremendous range of other functions. TSK nominally comes as a set of command-line tools, which you can use if you're comfortable with that, but you can also download a graphical interface called Autopsy that provides you with a powerful front-end for the tools in the kit .

One batch of data-carving and -recovery tools that is not open source but not commercial either, and worth mentioning as a postscript, is the PartitionSupport.com utilities, which run on 32-bit Windows and provide a host of functions for recovering data from damaged file systems of all kinds.

Among the apps available -- just to give you an idea of what they can do -- is FindJPG and FindDoc, which comb through a disk, cylinder by cylinder, and reconstruct all .JPG or .DOC files to the current directory, much like PhotoRec. Again, source code is not available for these tools, but they're easy to work with and freely available for individual use, which makes them fine as a personal or in-house recovery toolkit.