it turns out, that i have to recover a lot of files on NTFS drives. Most of them aren't overwritten yet, but due to the amount of data (50TB, no raid), i need a powerful tool for it.
- Recovery of directories, filenames and meta data as far as possible
- For time saving reasons: Reading directly from the drives, not from images
- Browsing the filesystem before recovering the data
Under Windows there are some programs for that, but... I would like a (free) linux alternative...
So far I've tested:
- testdisk: Very, very close... If it would just show me the results of the scan in a tree-view in which I could use "ls" and "cd"... But maybe it can and I just don't know?!
- Autopsy: Nope. Gui is nice, but afaik it can't read directly from disk and it's more for "deep analysis" than fast searching
- Scalpel: The config-file is nice, but still doesn't allow browsing through the date before recovery...
- Photorec: It's more or less the same as testdisk for me...
So if someone could point me to a good tool or tutorial, I' be grateful. Any help is appreciated ;)