Re: [sleuthkit-users] wrong filesystem ?

[Antoine J. <aja...@lp...>]

On Tuesday 20 May 2003 16:49, Brian Carrier wrote:
> The 'dls' tool with out the 'eb' will extract the unallocated space,
> so that will allow you to just run foremost or keyword searches on
> just the unallocated space.  Freebsd deletes the pointers from the
> inode structure to the data fragments, so there is no easy way to
> recover.  The last issue of the Sleuth Kit Informer had a quick blurb
> on using the group layout of a UNIX file system to recover files:

OK, I'll have a deeper lookt on all of that.
Thanks a lot for you suggestions.

Antoine