So recently I discovered "foremost"; a command line data recovery utility for #Linux that is pretty badass. It gives you an "audit" file to list everything it found, sorts files into directories based on their file extension and doesn't even have to work with physical disks. You can use dd to make a 1:1 copy of a disk and that image will also contain the fragments of deleted files so you can use foremost on anything from physical disks to a dd image and recover data with it. Pretty badass, 🙂
@gerowen absolutely amazing
@nerd7473 I knew it would do 1:1 copies of a block device regardless of media type, filesystem, etc., but it never occurred to me that you could perform data recovery on a dd image. I mean it makes sense; it is just recording the contents of sectors without worrying about the logical layout, so files marked as deleted but not actually purged from the drive would still have their data physically on the drive so dd would capture that. Pretty awesome stuff.