sleuthkit-users

[sleuthkit-users] how can I undelete a file on Linux ext3?

[beginner <a_b...@16...>]

SGVsbG8sDQoNCkRpZCBhbnlvbmUgaGFzIHN1Y2ggZXhwZXJpZW5jZT8NCg0KVGhhbmsgeW91IHZl
cnkgbXVjaCBmb3IgYW55IGhlbHAhDQoNCmJlZ2lubmVy

Re: [sleuthkit-users] how can I undelete a file on Linux ext3?

[Brian C. <ca...@sl...>]

On Aug 30, 2005, at 9:19 AM, beginner wrote:

> Hello,
>
> Did anyone has such experience?

You will probably need to rely on carving tools, such as foremost.   
The block pointers are cleared when an Ext3 file is deleted.  I did  
an article on this for Linux World:


Why Recovering a Deleted Ext3 File Is Difficult
http://linux.sys-con.com/author/5646Carrier.htm

brian