[sleuthkit-users] Help! - ghost files

[Metric US <mat...@ja...>]

I use Kubuntu 10.04

This happened using Skanlite to scan documents.

I had a working directory for skanlite ex: "Scanned"

I had at least 50 files in that directory and on Friday I attempted to scan 
more files. After scanning I checked the dir and in only contained the file I 
just scanned.

Since then I did the following:

A> Searching the file-system with Midnight Comander (in su mode) and
using "locate" and the pattern name for my files.

B> Using ext3grep to recover data. 

C> then using unrm and then combing through the large file with a little piece 
of software looking for "JFIF" 

None of these produced my files. I found all sorts of data (jpeg files) but not 
the ones I lost

So my question is: since the files are neither alive or dead could they be 
ghosts? 
eg: somewhere not actually deleted so that unrm can find them neither indexed 
and visible in the file-system.

Some more information:
1. The partition in question was ext3 and used solely to store data (no OS) 
2. I have unmounted it since to avoid writing over.
3. I am not crazy!
4. The night before the occurrence the system completed a self fsck during 
boot but no error messages are in the log.

Any suggestions/help?

Adrian