I was trying to retrieve a Windows address book off a partially-corrupt, fully-reformatted hard disk for someone—a task for which, if successful, I have been promised a good bottle of Bordeaux. I connected it up to a Linux machine to start the forensics, only to discover to my absolute joy that Linux could already read the files on it.

I’m not sure whether it was using a backup copy of the file allocation table (of which there are several in most disk formats), or just that the original format wasn’t properly completed, but either way, it made my job a lot easier.