low level search for deleted data

Andreas Burtzlaff andy13 at gmx.net
Mon Sep 27 14:56:57 UTC 2004


> On Sunday 26 September 2004 23:37, andy13 at gmx.net wrote:
> i use debugfs for that purpose

It doesn't work the "easy" way. lsdel doesn't finds any deleted inodes. I
think was already covered in another thread.

> > I lost my complete home directory and am facing the problem of
> retrieving
> > some of the deleted data.

Well, I've played around a bit with autopsy/sleuthkit and a 10Mb test image.
It isn't hard to recover text files, but I only tried to copy a file to the
file system and delete it afterwards. I expect fragmentation to make matters
Can anyone point me to a simple overview of things like blocks, groups,
inodes, etc. and fragmentation? What happens if I append some text to an
already existing text file?
It's really hard to find information on that on the net.

Thanks in advance


P.S. If I succeed I promise I'll write a mini howto about it

+++ GMX DSL Premiumtarife 3 Monate gratis* + WLAN-Router 0,- EUR* +++
Clevere DSL-Nutzer wechseln jetzt zu GMX: http://www.gmx.net/de/go/dsl

More information about the Ext3-users mailing list