text search on HDD

[mitaux8030]

Hi all,
This might seem a little like a PC forensics type question... I want to search all areas of the HDD, used & tagged as unused, for particular text. I'm wondering if some of my old MSN IM history that got too large (and was truncated) is still there dormant on my HDD. There was some information there that I remember, but want to recover if possible.
Is this possible, and what programs would you recommend?

In my 8-bit days, GCR encoding on floppies and hard discs made it very easy to search for text in sectors - each sector 'pointed' to the next, even if the allocation map showed those secotrs as being unused. Thus deleted files could fairly easily be recovered. I'm guessing not much has changed in the MFM and later schemes?

[Zero Alpha]

You have MSN set to store logs of your conversations right? Please explain what you mean by "got too large (and was truncated)"

You need to find the original logs if they still exists within the file system you are using. If they have been deleted then your only hope is whats left of them. Professionals use a tool that comes with UNIX called GREP and its bloody awesome.

[mitaux8030]

Well, if a MSN logfile gets over a certain size (1.5 Mb?) then you get a warning that earlier logs will be lost and newer entries will over-write the oldest. That's what it says in essence, but in reality the oldest entries may just be deleted, and the log file may continue to allocate fresh disk space for the newest entries. Note the liberal use of the word 'may' in that last sentence... it may or may not.

In any case, I found a freeware program called "disk investigator" does a simple text search - it can't concatenate sectors / cylinders, but at least you can search for and see the information there.