Re: Recommendation for undelete utility

[Nick Lewis <lewisnic () ACM ORG>]

You may also want to try the new freeware version of Technology Pathways
ProDiscover. You can download it from:

http://toorcon.techpathways.com/uploads/ProDiscoverRelease454Basic.zip

It has creation date, modified date, accessed date, and other details.

Nick

----- Original Message -----
From: "Chad McDonald" <chad.mcdonald () GCSU EDU>
To: <SECURITY () LISTSERV EDUCAUSE EDU>
Sent: Wednesday, December 07, 2005 10:07 AM
Subject: Re: Recommendation for undelete utility


> If this is for a forensic investigation to be used for criminal
> prosecution
> or if legal action may result, you should use EnCase from Guidance
> software.
> It is pricey and has a bit of a learning curve, but it is the standard for
> this type of software.
>
> More simply if this is for common data recover, I recommend R-Studio.
>
>
> Chad McDonald, CISSP
> Chief Information Security Officer
> Georgia College & State University
> Office    478.445.4473
> Cell       478.454.8250
>
>
> -----Original Message-----
> From: Jason Richardson [mailto:A00JER2 () WPO CSO NIU EDU]
> Sent: Wednesday, December 07, 2005 9:49 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] Recommendation for undelete utility
>
> Hi all, I'm looking for an undelete utility that will restore files
> deleted
> from a Windows system.  I found one that does a good job of undeleting
> them,
> but not restoring critical file attributes like time/date created.  Any
> recommendations?
>
> Thanks,
>
> ---
> Jason Richardson
> IT Security
> Enterprise Systems Support
> Northern Illinois University