Re: [sleuthkit-users] How to simply undelete files ?

[Barry J. G. <bg...@im...>]

On Tue, 2006-01-24 at 11:56 +0100, te...@me... wrote:

> I would like to know what is the simple procedure to recover one by one a few files which seems I good state to recover 
> (as the partition where I deleted files wasn't mounted since the deletion).

The ease of this will depend on the filesystem these files are on.  For
starters, have a look at the man page for icat (with the -r option).
use fls to find the inodes of deleted files, then pass the inode as an
argument to icat to recover the file.  Again, the sucess of this will
depend on the FS type.

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/