recovering deleted files

From: Damien Hull <dhull@digitaloverload.net>
Date: Sat Aug 19 2006 - 22:02:58 AKDT

A friend of mine called me this morning and said she deleted a file she
needed. I set her up with Xubuntu and ext3 for the file system. In the
end I told her it was a lost cause. However, I did do some searching on
the off chance there was a way to recover the file. Here's what I found.

NOTE: Some of these tools could damage your file system. Don't blame me
if you try this and loose data in the process.

Good how to on recovering files on ext3 file systems
http://linux.sys-con.com/read/117909_2.htm

The Sleuth Kit or TSK is talked about in the above article. There is an
Ubuntu package.
http://www.sleuthkit.org/sleuthkit/index.php

Here's one guys trip down recovery lane.
http://www.linuxquestions.org/questions/showthread.php?t=441914

Most of the instructions I ran into were ext2 related. Those
instructions won't work on ext3. It seams each file system stores data
in different ways. Each requires a different method of recovery. If you
don't have an ext3 file system I recommend you do some searching before
tampering with the file system.

I've never tried to recover a deleted file. I'm tempted to delete a file
and try to recover it just to say I've done it. It would also force me
to learn about cylinders, heads and sectors. I don't know anything
about them.

It all sounds like secret NSA stuff to me. Like I can see what's on your
drive even after you delete it. If someone gets to try this before me
let me know.
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Sat Aug 19 22:03:16 2006

This archive was generated by hypermail 2.1.8 : Sat Aug 19 2006 - 22:03:16 AKDT