Re: Recommendation for undelete utility

[Chad McDonald <chad.mcdonald () GCSU EDU>]

If this is for a forensic investigation to be used for criminal prosecution
or if legal action may result, you should use EnCase from Guidance software.
It is pricey and has a bit of a learning curve, but it is the standard for
this type of software.

More simply if this is for common data recover, I recommend R-Studio.


Chad McDonald, CISSP
Chief Information Security Officer
Georgia College & State University
Office    478.445.4473
Cell       478.454.8250


-----Original Message-----
From: Jason Richardson [mailto:A00JER2 () WPO CSO NIU EDU]
Sent: Wednesday, December 07, 2005 9:49 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Recommendation for undelete utility

Hi all, I'm looking for an undelete utility that will restore files deleted
from a Windows system.  I found one that does a good job of undeleting them,
but not restoring critical file attributes like time/date created.  Any
recommendations?

Thanks,

---
Jason Richardson
IT Security
Enterprise Systems Support
Northern Illinois University