Knoppix to the rescue!
Posted: Thu Nov 18, 2004 11:52 am
Just had a computer in here, our president's kids messed up their old laptop big time, and there was some big school project on there. (A log on their computer I found said that there were some 50 viruses/trojans/spyware on the machine!)
Didn't have a network card with it when they brought it in either...so how could I recover those files?
Well I downloaded a Knoppix ISO and burned it, and stuck it in the laptop, and a few minutes later up comes Linux, with windows (I think it uses KDE) and everything...the HDD is there (XP Pro drive) mounted, and I was able to browse through the files and find the word and XL documents (I could even open them via OpenOffice) - it was slow at times, seeing as each new computer had to be opened from the CD, but not too bad at all (this was an old Celeron 550)
So how did I get the files off? Well technically in this case, they would've fit zipped on a floppy - but I borrowed a USB key - and voila, it showed up - just had to choose mount, then make it writable, and I copied the files to the key, and thus to my own computer (and off to them via email). (scanned 'em good of course)
Good stuff, especially with a heavily infected machine - because the OS is burned to CD-ROM, no virus can touch it. Also it can read NTFS files, and it can even reset NT passwords...about the only time you might SOL is if they were encrypted - but even then in theory you could at least recover the files and try to decrypt later.
Cool stuff.
Didn't have a network card with it when they brought it in either...so how could I recover those files?
Well I downloaded a Knoppix ISO and burned it, and stuck it in the laptop, and a few minutes later up comes Linux, with windows (I think it uses KDE) and everything...the HDD is there (XP Pro drive) mounted, and I was able to browse through the files and find the word and XL documents (I could even open them via OpenOffice) - it was slow at times, seeing as each new computer had to be opened from the CD, but not too bad at all (this was an old Celeron 550)
So how did I get the files off? Well technically in this case, they would've fit zipped on a floppy - but I borrowed a USB key - and voila, it showed up - just had to choose mount, then make it writable, and I copied the files to the key, and thus to my own computer (and off to them via email). (scanned 'em good of course)
Good stuff, especially with a heavily infected machine - because the OS is burned to CD-ROM, no virus can touch it. Also it can read NTFS files, and it can even reset NT passwords...about the only time you might SOL is if they were encrypted - but even then in theory you could at least recover the files and try to decrypt later.
Cool stuff.