[sleuthkit-users] File attributes on a Linux second extended file system

[McMillon, M. <Mat...@qw...>]

I have a file that I believe was deleted after setting chattr +s on it.
Is there any way to confirm this?  Some scripts were found that show
that the user knew how to do this, but can't confirm that it was done on
a particular file.

Thank!

--
=20
Matt McMillon, GSEC
Staff Engineer - Qwest Corporate Security
=20
PGP Public Key:
http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0x2E0ABABE
=20
Only the named recipient(s) should read this e-mail and/or it's
attachments. It may contain privileged or confidential information.  If
you are not a named recipient or you received this e-mail by mistake,
please notify me immediately by reply e-mail and delete this message.
Quis custodiet istos custodus? =20