[sleuthkit-users] Problems Recovering EXT3 File Sleuthkit 1.7/Autopsy 2.0.1

[Darren H. <dar...@li...>]

Hello Brian and crowd,

I have been using Sleuth/Autopsy on Solaris for quite some time now. I
just gave a test run on Fedora Core 1. I am aware that it is impossible t=
o
recover  deleted Solaris files. What about ext3? I downloaded a couple of
JPEG's to a FC box, viewed them, deleted them, made a dd image. I can see
the deleted files in the "File Analysis" window in Autopsy. When I click
on the deleted file links, I get "File Type: Empty" and in the bottom
window "Contents Of File: /data/IMG_1237.sized.jpg" (the rest of the
window blank). When I try to export, I get a zero length JPEG file. Is it
possible to recover EXT3 files? Or is this going to be an RTFM post? :)

Thanks,

Darren

*************************
Secure and SPAM Filtered
litemail.org