[sf-lug] recovery after dd

[Sameer Verma]

I have an old external USB drive (120GB, I think) that had a bunch of
files and was close to full. I ran dd on it and installed a 2.1GB
image. The remainder of the space is unpartitioned.

Now, I plan on using a few tools to see what I can recover. The
following are candidates:

foremost
scalpel
photorec
testdisk
ext3grep

ext3grep project page warns not to mount the drive so that the old
unpartitioned space doesn't get written to. However, given that I have
a new partition via dd in 2.1 GB, that's the only space that will get
written to. The unpartitioned space should remain untouched. Is my
thinking correct?

If anyone on the list has any experiences with these tools, any
feedback would be much appreciated.

cheers,
Sameer
-- 
Dr. Sameer Verma, Ph.D.
Associate Professor, Information Systems
Director, Campus Business Solutions
San Francisco State University
http://verma.sfsu.edu/
http://opensource.sfsu.edu/
http://cbs.sfsu.edu/
http://is.sfsu.edu/