Re: [sleuthkit-users] How to simply undelete files ?

[farmer d. <far...@ya...>]

With ext3 you will have to carve for headers/footers
-OR- search for what you're looking for (IE, a key
word or phrase, hopefully unique :) ) due to how
deletion is handled.

regards,

farmerdude


--- "te...@me..." <te...@me...>
wrote:

> Hello,
> I think my problem is that the files were deleted on
> an EXT3 filesystem, it's certainly why icat doesn't
> find anything.
> 
> farmer dude wrote:
> > Hi,
> > 
> > Your success will depend largely on the file
> system
> > type the deleted files reside on.  What type?
> > 
> > Using The Sleuth Kit you can use 'icat' to
> undelete
> > deleted files.
> > 
> > Other utilities are available that can assist,
> > depending upon the file system type.
> > 
> > regards,
> > 
> > farmerdude
> > 
> > THE FARMER'S BOOT CD
> 
> 
> 
>
-------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do
> you grep through log files
> for problems?  Stop!  Download the new AJAX search
> engine that makes
> searching your log files as easy as surfing the 
> web.  DOWNLOAD SPLUNK!
>
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com