[sleuthkit-users] How to simply undelete files ?
Brought to you by:
carrier
From: <te...@me...> - 2006-01-24 10:55:02
|
Hello everybody, I'm new to sleuthkit,and I've got a problem which might seem very basic to most og you but I can't resolve it : I recently burned some files from my hard-disk to a CD / RW, then I deleted these files from my hard-disk. When I tried to read the CD, there seems to be nothing on it. I wasn't able to dd an image of the cd, so I can't recover my files this way. Then I launched autopsy on my hard-disk. Using File analysis, I can see all the deleted files, but now, I don't know how to recover them. I don't want to use the sorter tool from autopsy because I don't have enough free space to copy all the recovered files, only enough for the 700Mb of my deleted files. I would like to know what is the simple procedure to recover one by one a few files which seems I good state to recover (as the partition where I deleted files wasn't mounted since the deletion). |