US Intelligence wants their data back

“Are any of these documents missing from your possession?” “Nothing is missing, we want what belongs to us back.”

Wait… You want your digital leaked information..back? Would you like that in a specific format? Should I share it with you via torrent?

Defense Department Press Briefing

I recommend you watch the streaming video, it’s actually funny.

The following information posted by WikiLeaks sums it up: What we didn’t hear from the Pentagon last week: “Killing all those innocent people is bad. Sorry. We will stop that”.

By |August 6th, 2010|Categories: General|Tags: , |0 Comments

Backups usually help

So last Friday (May 1st, 2009) I was asked at work to upgrade the hard drive in the CEOs laptop. Alright no problem, we go to the closest store and pick up a new two hundred and fifty gigabyte hard drive to put in the laptop. I get the new drive and decide to make sure the old drive has no errors before I image the disk over.

I run the usual Windows `chkdsk` commands and it finds some stuff and fixes it quickly. I put the new drive on a small external USB adapter and throw in the TRK Rescue disc to run a `dd` on the drive. The program completes, and I put the new drive into the system. The new drive boots up and all is fine. I can resize the partition later when I have more time.

A little later I get a phone call saying that there are no folders in the CEOs Outlook Pane. “Alright.” So I walk up and take a look, sure enough no folders under the six PST files that were mounted from the local hard disk. I close the Personal Folders and then remount then in Outlook. Nothing. “Alright…”

So I browse to the My Documents folder where the files are kept and I search around. I find the six PST files. Looking over them, file size: 0 bytes. Yeah, zero bytes. Three of these files were over two gigabytes (2GB) and the other three were in the range of eight hundred megabytes (800MB). Now, we have a problem.

I come to find out that the `chkdsk` run found something wrong with these large files and marked them as zero bytes in the file table on the drive.

So I quickly take the original hard disk down to my system here and throw it on the USB adapter and start running a simple undelete utility on the files. It finds them, but still as zero bytes, and only restores a zero byte file. Now we have a larger problem. So I start searching around the Internet for some utilities that will scan the disk and reconstruct the damaged or missing PST files.

I come to find a program called Office Recovery by DiskInternals. The program installed, and I had it scan the disk. This took forever on my little machine but after many hours found the parts and displayed them to me. I was able to save the mail to a PST file on my primary hard disk. But still a problem, all of the new messages had their times erased and most of the messages have the `From:` field replaced with their Exchange counterparts /O= and /OU= stuff.

I need to recover the files themselves, not the contents. So a little more searching and reading up and I find out that a program I found a long time back can help. So I installed X-Ways Forensics, and had it scan the external disk. Following some bits and peices of information around the Internet I was able to do a File Recovery by Type. This scans the entire disk for any fi