[Berbagi] Scalpel, Recovery File yg Terhapus oleh ‘Shift + D

Aplikasi-aplikasi diubuntu: • Aplikasi Grafis •
Aplikasi Internet •
Aplikasi Office •
Aplikasi Sound & Video •
Aplikasi Programming
Post Reply
User avatar
thrvers
Contact:

[Berbagi] Scalpel, Recovery File yg Terhapus oleh ‘Shift + D

Post 27 Dec 2011, 13:26

A Frugal, High Performance File Carver

A fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files.
Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery.
  • install scalpel, bisa lewat UbuntuSoftwareCenter, Synaptic atau

    Code: Select all

    $ sudo apt-get install scalpel
  • kenali partisi tempat file tersebut terhapus, misal di /home/thrvers/Documents/file.pdf
    misal dengan bantuan terminal, buat mencari /home berada dipartisi mana?

    Code: Select all

    $ df -h
    $ sudo fdisk -l
    $ pwd
    dan lain-lain
  • identifikasi tipe file, misal contoh diatas tipe file pdf

    Code: Select all

    $ sudo gedit /etc/scalpel/scalpel.conf
    hilangkan tanda pagar (#) seperti contoh, lalu simpan:

    Image
  • cara mengembalikan data, contoh:

    Code: Select all

    $ sudo scalpel /dev/sda3 -o /home/thrvers/Desktop
    dimana:
    - /dev/sda3 : dapat dikenali dari step no.2 diatas
    - -o : output ke folder (terserah, yg penting folder kosong)

    Image
  • Hasilnya:

    Image

    Setelah dicari2, ketemu juga:
    Image
Mesin tes: Intel E5400 2.7GHz, RAM 1GB, Filesystem ext4
Sumber: Recover Your Deleted Files In Linux using Scalpel Utility

- Selamat Mencoba -


User avatar
IntegerManual

Post 27 Dec 2011, 13:33

Bookmarked :)
Kebetulan, thankx berat...


User avatar
ilham2930
Contact:

Post 27 Dec 2011, 14:06

nice share masbro..

btw, itu gambarnya di edit y masbro, hiksss.... :D :grin:


User avatar
thrvers
Contact:

Post 27 Dec 2011, 14:47

'
ilham2930 wrote:...
btw, itu gambarnya di edit y masbro, hiksss.... :D :grin:

OOT
sambil belajar gimp mas ilham2930 :malu:


User avatar
Malsasa

Post 27 Dec 2011, 16:05

Menjurus ke keahlian forensik. Moga-moga bermanfaat dan tidak disalahgunakan :D


User avatar
thrvers
Contact:

Post 27 Dec 2011, 21:52

'
lisnux wrote:coba dulu ah ....

paling suka kalau ada yg mencoba juga :grin:
[spoiler]tinggal nunggu laporannya[/spoiler]


User avatar
buzzing_bee
Contact:

Post 27 Dec 2011, 22:15

itu beneran di delete mas pdfnya ??? :D
dan bener2 ke recover nda ?? :D

aku pernah pake scalpel tapi kok gagal ya :confused:


User avatar
thrvers
Contact:

Post 27 Dec 2011, 23:12

'
buzzing_bee wrote:itu beneran di delete mas pdfnya ??? :D
dan bener2 ke recover nda ?? :D

aku pernah pake scalpel tapi kok gagal ya :confused:

beneran kak buzzing_bee :D = apa mungkin versi 1.60 yah??
q tes /home/thrvers/Documents/file.pdf (ukuran 1.6MB)
(dari beberapa file diatas ada juga yg pdf kosong)

NB: maaf q samarin nama filenya :D - isinya manual book distro.


User avatar
enoW

Post 08 Feb 2013, 00:41

Trimakasih infonya. Bookmarked.


User avatar
neha
Contact:

Post 08 Feb 2013, 23:38

gan, ane barusan migrasi dari windows k ubuntu, trus salh instal, jadi nya HD ane yg semula 3 partisi (C,D,E) jadi hilang dan semua data kehapus,.ap bsa di balikin pke ini gan?
mohon pncerahanny gan


User avatar
thrvers
Contact:

Post 08 Feb 2013, 23:47

'
kak neha, silakan cari bahasan tentang 'testdisk' untuk masalah tersebut.

sedangkan 'scalpel' untuk masalah file yang terhapus, bukan partisi.


User avatar
neha
Contact:

Post 11 Feb 2013, 18:19

bos, tolong dong, spt ny recovery sukses, tpi file/folder hasil recovery ga bisa di buka,

penampakan ny gan,.


gmn nih gan bwt bsa buka ny?
Attachments
penampakan.jpg
penampakan.jpg (563.9 KiB) Viewed 1198 times


User avatar
sta

Post 15 Feb 2013, 10:24

@neha coba buka terminal > ketik : sudo nautilus /home/neha


Post Reply

Who is online

Users browsing this forum: No registered users and 31 guests