I lost my excel file there are alots of data. Is there any way to get it back?
#4
as mentioned every write process could destroy your data, so turn of your pc

(you will need another storage device like an external usb-drive to store the data)

if the file was stored on an additional harddrive except for your systemdrive, unplug it, this way you can till use your systemdrive to prepare the needed tools ->

depending on your knowledge or ask a friend, make a bootable K.a.l.i Linux USB-Stick, set up your bios/UEFI to boot from that stick, first do a try run without replugging your drive and start into K.a.l.i forensic mode (this way all attached harddisk will mounted read only) if this works, turn of your pc, replug your hard drive and start again

use guymager to get a forensic 1:1 copy of your disk, use encase E01 Format with fast compression (this way empty space is compressed/skipped) and store it to your external drive, now you have a unaltered copy of your data you can work with hint you need to start guymager explicit as root, otherwise it will crash when choosing your external drive as storage

you can use linux (sleuth kit together with autopsy) or autopsy for windows, maybe i would use this if you are not familiar with linux at all, install, import your forensic image into autopsy and start scanning for deleted files (maybe your file is alread shown where it was stored, so try looking there first
Reply


Messages In This Thread
RE: I lost my excel file there are alots of data. Is there any way to get it back? - by Snoopy - 09-10-2024, 01:04 PM