My sister had a friends laptop factory reset and there were pictures on it that
we are trying to get back. What options do we have. I know forensic recovery via a company is an option. Are there any others.
Egnever
(21,506 posts)Every operation at this point has the potential to overwrite the pictures if they aren't overwritten already.
The drive should be pulled and then gone through with a file recovery program. There are many available I can't think of the names of any I have had good luck with off the top of my head but you should be able to Google them.
Most important though is to stop using that drive immediately. The pics may already be gone but if they aren't every single thing you do with that machine has the potential to erase them forever.
eppur_se_muova
(36,299 posts)Probably the simplest thing to do is download and boot from the CAINE CD: http://www.caine-live.net/
There's also r-undelete: http://www.r-undelete.com/
And you can try KNOPPIX, but I haven't had as much luck there: http://www.knopper.net/knoppix/index-en.html
Be sure your laptop is set to boot from the CD. The CAINE CD will mount all drives as read-only, which prevents you from damaging the files further. You then need to mount one drive (probably a USB drive) as read-write, using right-click on the icon at bottom center of screen. You will save your files to that drive. There are several recovery utilities on the CD, including TestDisk and PhotoRec, but Autopsy/Sleuthkit is perhaps the best integrated for this particular CD. There is a .pdf tutorial at the CAINE site, but maybe slightly outdated -- use the procedure above to mount read-write disk, not the version in the .pdf.
Some other links from earlier:
http://www.democraticunderground.com/109515354
http://www.democraticunderground.com/109513084#post2 <-- Windows 7 or later, try this first
You didn't mention what OS you're using, I'm guessing Windows. If so you might have Hiren's Boot CD, which I *think* includes TestDisk and PhotoRec. If not both are on the CAINE boot CD. Both use an "ASCII-GUI" interface -- kind of a pain but necessary to ease porting between various OS's.
Hope this helps, and welcome to the dark art of file recovery !