low level search for deleted data

[Andreas Burtzlaff]

Hi,

> On Sunday 26 September 2004 23:37, andy13 at gmx.net wrote:
> 
> i use debugfs for that purpose

It doesn't work the "easy" way. lsdel doesn't finds any deleted inodes. I
think was already covered in another thread.

> 
> > I lost my complete home directory and am facing the problem of
> retrieving
> > some of the deleted data.

Well, I've played around a bit with autopsy/sleuthkit and a 10Mb test image.
It isn't hard to recover text files, but I only tried to copy a file to the
file system and delete it afterwards. I expect fragmentation to make matters
worse.
Can anyone point me to a simple overview of things like blocks, groups,
inodes, etc. and fragmentation? What happens if I append some text to an
already existing text file?
It's really hard to find information on that on the net.

Thanks in advance

Andreas

P.S. If I succeed I promise I'll write a mini howto about it

-- 
+++ GMX DSL Premiumtarife 3 Monate gratis* + WLAN-Router 0,- EUR* +++
Clevere DSL-Nutzer wechseln jetzt zu GMX: http://www.gmx.net/de/go/dsl