Data Recovery: a collection of software

This is a list of some Data Recovery software

Active@ Undelete

http://www.active-undelete.com/


Active@ Partition Recovery

http://www.partition-recovery.com/


Discovery Recovery - Drive Discovery

http://www.notsosoftware.com/


Easy Undelete

http://www.easy-undelete.com/


COMPUTOOLZ Data Recovery

http://www.computoolz.com/


File Recover

http://www.pctools.com/file-recover/


File Scavenger

http://www.quetek.com/prod02.htm


File Recovery Angel

http://www.filerecoveryangel.com/


File Rescue Plus

http://www.filerescueplus.com/


Final Recovery

http://www.finalrecovery.com/


FinalData

http://www.finaldata.com/


GetData

http://www.getdata.com/


GetDataBack

http://www.runtime.org/


Handy Recovery

http://www.handyrecovery.com/


Max Data Recovery

http://www.softeza.com/datarecovery/


O&O (Data Recovery Section)

http://www.oo-software.com/home/en/datarecovery/


Object Rescue

http://www.objectrescue.com/


Ontrack Data Recovery

http://www.ontrackdatarecovery.com/


PC Inspector File Recovery

http://www.pcinspector.de/Sites/file...htm?language=1


ProSoft

http://www.prosofteng.com/


RecoverSoft

http://www.recoversoft.com/


R-Studio

www.r-tt.com


Search and Recover

http://www.iolo.com/sr/5/


Smart Undelete

http://www.recoverdeletedfilestool.com/


Spin Rite

http://www.grc.com/spinrite.htm


Stellar Phoenix

http://www.stellarinfo.com/


SUPERFileRecover

http://www.superfilerecover.com/

Creddump

Creddump is a Freeware/Opensource set of tools written in Python allowing to retrieve system informations that Windows would like to keep hidden from our prying eyes:

• LM and NT hashes (SYSKEY protected)
• Cached domain passwords
• LSA secrets

these infos are stored encrypted inside the Windows Registry. Creddump is the only application to combine all the following features:

1) it returns all the above infos
2) it extracts these infos directly from the Registry files (offline retrieval)
3) it's Freeware/OpenSource
4) it's Cross-Platform (any platform with a supported Python compiler)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
OVERVIEW

creddump is a python tool to extract various credentials and secrets from Windows registry hives. It currently extracts:

* LM and NT hashes (SYSKEY protected)
* Cached domain passwords
* LSA secrets

It essentially performs all the functions that bkhive/samdump2, cachedump, and lsadump2 do, but in a platform-independent way.

It is also the first tool that does all of these things in an offline way (actually, Cain & Abel does, but is not open source and is only available on Windows).

REQUIREMENTS

alldump has only been tested on python 2.5. It should work on 2.4 as well, but will likely need modification before it will work on 2.3 or below.

python-crypto is required for its MD5/DES/RC4 support. To obtain it, see:

http://www.amk.ca/python/code/crypto

For lsadump: system and SECURITY hives
For cachedump: system and SECURITY hives
For pwdump: system and SAM hives

USAGE

Dump cached domain hashes:
usage: ./cachedump.py

Dump LSA secrets:
usage: ./lsadump.py

Dump local password hashes:
usage: ./pwdump.py

FEATURES

* Platform independent operation. The only inputs are the hive files from the system--we don't rely on any Windows functionality at all.
* Open-source and (hopefully!) readble implementations of Windows obfuscation algorithms used to protect LSA secrets, cached domain passwords, and
* A reasonably forgiving registry file parser in pure Python. Look through framework/types.py and framework/win32/rawreg.py to see how it works.
* The first complete open-source implementation of advapi32's SystemFunction005. The version in the Wine source code does not appear to allow for keys longer than 7 bytes, while the Windows version (and this version) does. See decrypt_secret() in framework/win32/lsasecrets.py

AUTHOR

creddump is written by Brendan Dolan-Gavitt (bdolangavitt@wesleyan.edu). For more information on Syskey, LSA secrets, cached domain credentials, and lots of information on volatile memory forensics and reverse engineering, check out:

http://moyix.blogspot.com/

CREDITS

* AAron Walters. Much of the data type parsing code is taken from Volatility, an excellent memory analysis framework written in Python. He's also a really nice guy, and has helped me out a lot in my research.

https://www.volatilesystems.com/default/volatility

* Massimiliano Montoro (mao), for reversing the mechanism Windows uses to derive the LSA key so that it can be computed directly from the hive files, as decribed in this post:

http://oxid.netsons.org/phpBB2/viewtopic.php?t=149
http://www.oxid.it/

* Jeremy Allison, for the details of the obfuscation applied to password hashes in the SAM, as implemented in the original pwdump.

http://us4.samba.org/samba/ftp/pwdump/

* Nicola Cuomo, for his excellent description of the syskey mechanism and how it is used to encrypt the SAM in Windows 2000 and above.

http://www.studenti.unina.it/~ncuomo/syskey/

* Eyas[at]xfocus.org, for x_dialupass2.cpp, which demonstrates how to read LSA secrets directly from the registry, given the LSA key.

http://www.xfocus.net/articles/200411/749.html

[Note: the above is in Chinese, but quite comprehensible if you use Google Translate and can read C ;)]

* Nicholas Ruff, for his perl implementation of des_set_odd_parity, which he apparently took from SSLEAY:

http://seclists.org/pen-test/2005/Jan/0180.html

* Arnaud Pilon, for the details of how to retrieve cached domain, as implemented in cachedump.

http://www.securiteam.com/tools/5JP0I2KFPA.html

* S�bastien Ke, for his cute hexdump recipe:

http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/142812

LICENSE

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

homepage: http://code.google.com/p/creddump/
author: http://moyix.blogspot.com/

docs:
Cached Domain Credentials
Decrypting LSA Secrets
SysKey and SAM
Creddump: extract credentials from Windows Registry Hives

Pass-The-Hash Toolkit

(Freeware/OpenSource)

Home: http://oss.coresecurity.com/projects/pshtoolkit.htm

Blog: http://hexale.org/forums/

current version: 1.4 (July 2, 2008)

********************************
What is Pass-The-Hash Toolkit?


The Pass-The-Hash Toolkit contains utilities to manipulate the Windows Logon Sessions mantained by the LSA (Local Security Authority) component. These tools allow you to list the current logon sessions with its corresponding NTLM credentials (e.g.: users remotely logged in thru Remote Desktop/Terminal Services), and also change in runtime the current username, domain name, and NTLM hashes (YES, PASS-THE-HASH on Windows!).


Utilities in the toolkit:

• IAM.EXE/IAM-ALT.EXE:
  Pass-The-Hash for Windows. These tools allows you to change your current NTLM credentials withouth having the cleartext password but the hashes of the password. The program receives a username, domain name and the LM and NT hashes of the password; using this it will change in memory the NTLM credentials associated with the current windows logon session. After the program performs this operation, all outbound network connections to services that use for authentication the NTLM credentials of the currently logged on user will utilize the credentials modified by IAM.EXE. This includes 'net use', 'net view', many third-party DCOM services that use NTLM authentication, etc. This is basically 'pass-the-hash' for windows; one of the main advantages is that you don't need to use a modified version of samba or samba-tng and be restricted to the limited functionality they implement, you can now use windows and any third-party software with stolen hashes withouth having to obtain the cleartext version of a password. For more information take a look at this paper I wrote back in 2000 Modifying Windows NT Logon Credentials.
• WHOSTHERE.EXE/WHOSTHERE-ALT.EXE:
  These tools will list logon sessions with NTLM credentials (username,domain name, LM and NT hashes). Logon sessions are created by windows services that log in using specific users, remote desktop connections, etc. This tool has many uses, one that i think is interesting: Let's say you compromised a Windows Server that is part of a Windows Domain (e.g.: Backup server) but is NOT the domain controller. Since it is not the domain controller, you only have access to the local SAM and although you did effectively comprise a sensitive server you did not compromise the domain. However, it is very common in such situations to find that administrators are using Remote Desktop to connect to the compromised server to perform different tasks. So this is your chance, just wait for the administrator to log into the compromised server using remote desktop, at that point, run 'WHOSTHERE.EXE' and you will observe the administrators username,domain name, and NTLM hashes. Now go to your machine, use them with IAM.EXE and compromise the domain controller using the administrator's credentials.
• GENHASH.EXE:
  This is a small utility that generates LM and NT hashes using some 'undocumented' functions of the Windows API. This is a small tool to aid testing of IAM.EXE.

Setup


Quick start:There's not much to be done, extract the .tgz file and have fun!.

Requirements

• You can compile the tools using Microsoft Visual C++ 2005 Express Edition (available at http://msdn.microsoft.com/vstudio/express/). Minor modifications might be needed to compile them using other C compilers.
• You must have Administrator privileges to run these tools (except for genhash.exe).
• IAM.EXE was mostly tested on WinXP and Windows Server 2003, although it should also work on Vista. WHOSTHERE.EXE now works correctly on Windows Server 2003. Support for Vista will be added.

Cleartext Passwords in Linux Memory

(Jun 11, 2008)
http://philosecurity.org/research/cleartext-passwords-linux

During the last few months I’ve investigated Linux memory, and consistently found cleartext passwords– including my login, SSH, email, IM, Truecrypt, and root passwords. The following paper includes details regarding each password’s location in memory and surrounding context.

Cleartext Passwords in Linux Memory (pdf)

Given the recent developments with cold boot memory dumping, the risk associated with cleartext passwords and other sensitive data in memory has significantly increased. Last week at HOPE Jacob Appelbaum released some of the cold boot tools which the Princeton, EFF and Wind River team used to dump and analyze memory.
My hope is that detailed information about cleartext passwords will be useful to forensic examiners and the Linux development community. For folks who would like to examine the data for themselves, below are a some snippets of process memory that I collected from my Ubuntu test system.
Each zipfile contains a pcat capture of process memory, as well as files containing the Ascii and Unicode strings. In the GDM process memory, you’ll find the login username, password, and shadow file information. In the Truecrypt process memory, you’ll find the volume location, password, and the command used to mount it.

There’s other interesting stuff in there as well.

GDM process memory (.zip, 6.0M)
login username: myname1
password: !1MyPwd1!

Truecrypt process memory (.zip, 7.5M)
volume location: /home/myname1/Desktop/tcvol
password: !mytcvol!
shell command: truecrypt Desktop/tcvol)


Sherri Davidoff

SSMM - Slide Show Movie Maker

http://www.joern-thiemann.de/tools/SSMM/index.html

This is a cool and easy to use Freeware software that allows you to build movies from a set of pictures; it features great transitional effects from a picture to the next, the possibility to add a soundtrack, and more ...

Slide Show Movie Maker is a free program that can create an AVI-file from a series of .bmp or .jpg images. Images can have professional-looking fade-in and fade-out effects plus attractive text overlays. The program's clean-looking interface is logically laid out; you should become productive within just a few minutes of running it. Keep in mind that .avi files can become quite large and take a long time to render. However, Slide Show Maker lets you choose to save output using any one of your system's installed .avi codecs, so the file size and generation time will vary depending upon which one you choose.

VPatch - Free Patch Generator

Homepage: http://www.tibed.net/vpatch/

VPatch is a Freeware/OpenSource application that allows you to create a patch file to update previous versions of a given file.

current version: 3.2 (January 2008)

**********************************
VPatch 3.2

Introduction

VPatch allows to create a patch file to update previous versions of your software. The GenPat utility generates the patch file. The plug-in can use the patch to update a file. Using a patch, you can reduce the download size of your updates, because only the differences between the files are included in the patch file.

How to use

Generate the patch file

Make sure you have the source file (original version) and the target file (version to update to). For example, DATA.DTA (currently on user system) and DATA_20.DTA (version 2.0 of this data file). Now call the command line tool GenPat.exe:

GENPAT oldfile.txt newfile.txt patch.pat

Now, the patch will be generated, this will take some time.

Using the /B=(BlockSize) parameter of the GenPat utility (put it after the filenames), you can use a different block size. A smaller block size may result in a smaller patch, but the generation will take more time (the default blocksize is 64).

If you have trouble using this command-line utility, you can download a GUI (graphical user interface) for VPatch from its own website: http://www.tibed.net/vpatch.

Update the file during installation

Use the VPatch plug-in to update a file using a patch file:

vpatch::vpatchfile "patch.pat" "oldfile.txt" "temporary_newfile.txt"

The result of the patch operating will be added to the stack and can be one of the following texts:

• OK
• OK, new version already installed
• An error occurred while patching
• Patch data is invalid or corrupt
• No suitable patches were found

Check example.nsi for an example. You should check whether the stack string starts with "OK" because then the patch has succeeded and you can rename "temporary_newfile.txt" to "oldfile.txt" to replace the original, if you want.

Multiple patches in one file

GenPat appends a patch to the file you specified. If there is already a patch for the same original file, with the same CRC/MD5, in the patch file, the patch will be replaced. For example, if you want to be able to upgrade version 1 and 2 to version 3, you can put a 1 > 3 and 2 > 3 patch in one file.

You can also put patches for different files in one patch file, for example, a patch from file A version 1 to file A version 2 and a patch from file B version 1 to file B version 2. Just call the plug-in multiple times with the same patch file. It will automatically select the right patch (based on the file CRC).

Patch generator (GenPat) exit codes

In version 3 the following exit codes (known as error levels in the DOS period) can be returned by GenPat. GenPat will return an exit code based on success of the patch generation. Here is a list of the possible exit codes:

Exit code <-> Description
0 <-> Success
1 <-> Arguments missing
2 <-> Other error
3 <-> Source file already has a patch in specified patch file (ERROR), use /R switch to override

These exit codes can be useful when you generate patch files through a NSIS script.


Source code

Source code is available in the original package and in the SVN repository of NSIS.

NSIS plug-in (C++)

The source of the NSIS plug-in that applies patches can be found in the Source\Plugin folder.

Patch Generator (C++)

The most interesting part of VPatch, the actual patch generation algorithm, can be found in Source\GenPat32\PatchGenerator.cpp. The header of that file contains a brief explanation of the algorithm as well.

User interface (Delphi)

A user interface is included as well, which you will have to build yourself because the GUI executable was too large to include. Besides Borland Delphi 6 or higher (you can use the freely available Personal edition), you will also need to install the VirtualTreeView component by Mike Lischke.

Test framework (Python)

Run the VPatch_tests.py script (if you have Python installed) to perform basic functionality tests on VPatch. The testExtended test is known to fail if a set of big test files is not installed, you can safely ignore this.

Credits

Written by Koen van de Sande
C plug-in initially by Edgewize, updated by Koen van de Sande
New documentation and example by Joost Verburg and Koen van de Sande

License

Copyright (C) 2001-2008 Koen van de Sande / Van de Sande Productions

This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.

Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required.
2. Altered versions must be plainly marked as such, and must not be misrepresented as being the original software.
3. This notice may not be removed or altered from any distribution.

and now some insight:

Using the interface

Step 1. Start the interface (VPatchGUI.exe).
Step 2. Hit the "Add new version" button. Now, select the latest version of your file. Right after that, another file selection screen pops up. Now, select all older versions of your file (which need to be updated).
Step 3. You're set, you can add more files if you want through the "Add new version" button.
Step 4. Configuration: By default a "Block size" of 64 is configured. If you make it smaller, you will get smaller patch files. You can set this to 16 to squeeze out even that last byte, but applying the patch file can get slower when using such small block sizes. Also, memory usage during patch generation will be higher.
Step 5. Hit "Generate patches" from the Action menu. Your patches are now being generated.
Step 6. If you select "Create patch file" now, the program will create an PAT which contains the information needed to update all old files to new versions. This PAT file can be used to update files. If you want to do this with NSIS, see the other readme file. If you want to use it standalone, you should create an EXE file instead of a PAT file. However, the recommended way to use patches with NSIS now uses plugins, see the other readme for info about that.

• The 'Create PAT' option is for creating a patch for use with NSIS 2
• The 'Create EXE' option is for creating a patch attached to a stand-alone EXE. Read below for steps on how to use this command-line patch.
• The 'Create DLL' option is for creating a patch attached to a stand-alone DLL (useful for Inno Setup)

Using command-line utilities

Step 1: Creating the patch file(s)

Make sure you have the source file (original version) and the target file (version to update to). For example, I have DATA.DTA (currently on user system) and DATA_20.DTA (v2.0 of this data file). Now call GenPat.exe:

GENPAT (sourcefile) (targetfile) (patchfile)

In my example, I use the following call:

GENPAT data.dta data_20.dta data.pat

Now, the patch will be generated. This will take some time. You can repeat
this step for multiple different files:

GENPAT title.pcx title2.pcx data.pat

Note: GenPat returns an error code if something went wrong as of v2.1. Please see the other readme for a description of these error codes.

Step 2: Piecing things together

The patch files created in step 1 should now be attached to the VPatch runtime. Or read the alternative step 2 below. Once attached, you can run this file on the target system and it will update the files. In order to piece the patch files together, use VAppend.exe:

VAPPEND (patchfile) [output file] [runtime]

This will create a file called VPatch.exe by default, which is the actual patch. The default runtime is VPatch.bin. In my example:

VAPPEND data.pat

So this is the same call as:

VAPPEND data.pat vpatch.exe vpatch.bin

Note that "vpatch.bin" corresponds to "Create EXE" in the GUI and that "vpatchdll.bin" corresponds to "Create DLL" in the GUI. The stand-alone patch (which is not attached to a runtime) is the one you get if you use "Create PAT" in the GUI.

Step 3: How to use it (the command-line EXE version)

If you want to use your patch in NSIS, please read the other readme. This description is about the stand-alone EXE version.
Now that the patch is ready, you (could) use it. You can call VPatch.exe in the following way:

VPATCH.EXE (sourcefile) (outputfile)

IMPORTANT: You must specify the full filename of VPatch, so VPatch.exe. If you call it using just "VPatch" then you will get an error.
In the example this would be:

VPATCH.EXE data.dta data.new

This way, VPatch will use data.dta and patch it. It will create data.new, which contains the new version. The original data.dta isn't touched. If the file data.new isn't created, an error must have occured.
If you have multiple files attached, you can make multiple calls to VPatch. The program will automatically choose the correct patch for the file:

VPATCH.EXE data.dta data.new
VPATCH.EXE title.pcx title.out

Step 2 (alternative): stand-alone runtime and patch

If you do not want to attach your patch file to a runtime, you can also use it in a more stand-alone manner using the VPatchPrompt.exe runtime. This runtime will first check if it has a patch attached and, if it does not, it will take the patch file as the first command-line argument:

VPATCHPROMPT.EXE (patchfile) (sourcefile) (outputfile)

Another feature of this runtime is that it will prompt the user for a filename, if a command-line argument is not specified. Therefore, if you call VPatchPrompt without arguments, you will be prompted for all three command-line options (or, if you have attached a patch to the VPatchPrompt runtime using VAppend, it will only prompt for the source and output files).

NTFS-3G

The NTFS-3G driver is a freely and commercially available and supported read/write NTFS driver for Linux, FreeBSD, Mac OS X, NetBSD, Solaris, Haiku, and other operating systems. It provides safe and fast handling of the Windows XP, Windows Server 2003, Windows 2000 and Windows Vista file systems.

NTFS-3G develops, quality tests and supports a trustable, feature rich and high performance solution for hardware platforms and operating systems whose users need to reliably interoperate with NTFS.

The driver is in STABLE status since 2007. It is used by millions of desktop computers, consumer devices for reliable data exchange, and referenced in more than 20 computer books. Please see our test methods and testimonials on the driver quality page.

it is also used in the current release of the Offline NT Password & Registry Editor, Bootdisk / CD

2008-08-02

• Now uses NTFS-3g as NTFS filesystem driver.
• This hopefully removes some problems regarding dirty and "bad flags" NTFS volumes.
• You will be asked if you like to force your way and continue anyway if the disk has been uncleanly shut down.
• There exists a small chance of problems with the very latest written files before the unclean shutdown if you select to force it.
• Safest is still to boot into windows and shut down properly if that is possible with an unclean volume.
• Path select now hopefully better at detecting default suggestion and to actually find it...
• Newer kernel, and probably newer and better drivers.
• No changes to the passord/registry edit program (chntpw) since last release.
• Sorry, did not have the time to finish the floppy version yet.

Current stable version: 1.5130 (November 30, 2008)
Current test version: 1.5222-RC (December 22, 2008)