Re: recovering deleted files

I have successfully recovered ext3 data with Sleuthkit/Autospy for customers
and myself. I recommend that route. Plus, fairly simple learning curve.

good luck,
--eddie

>From: Greg Madden <pabi@gci.net>
>To: aklug@aklug.org
>Subject: Re: recovering deleted files
>Date: Sun, 20 Aug 2006 10:53:39 -0800
>
>On Saturday 19 August 2006 22:02, Damien Hull wrote:
> > A friend of mine called me this morning and said she deleted a file she
> > needed. I set her up with Xubuntu and ext3 for the file system. In the
> > end I told her it was a lost cause. However, I did do some searching on
> > the off chance there was a way to recover the file. Here's what I
> > found.
> >
> > NOTE: Some of these tools could damage your file system. Don't blame me
> > if you try this and loose data in the process.
> >
> > Good how to on recovering files on ext3 file systems
> > http://linux.sys-con.com/read/117909_2.htm
> >
> > The Sleuth Kit or TSK is talked about in the above article. There is an
> > Ubuntu package.
> > http://www.sleuthkit.org/sleuthkit/index.php
> >
> > Here's one guys trip down recovery lane.
> > http://www.linuxquestions.org/questions/showthread.php?t=441914
> >
> >
> > Most of the instructions I ran into were ext2 related. Those
> > instructions won't work on ext3. It seams each file system stores data
> > in different ways. Each requires a different method of recovery. If you
> > don't have an ext3 file system I recommend you do some searching before
> > tampering with the file system.
> >
> > I've never tried to recover a deleted file. I'm tempted to delete a
> > file and try to recover it just to say I've done it. It would also
> > force me to learn about cylinders, heads and sectors. I don't know
> > anything about them.
> >
> > It all sounds like secret NSA stuff to me. Like I can see what's on
> > your drive even after you delete it. If someone gets to try this before
> > me let me know.
>
>I noticed Gnome & KDE use a Trash icon/folder. Probably moving files to
>Trash instead of a delete is closer to the Windows experience.
>
>Recover deleted files from your backup ;-)
>
>--
>Greg Madden
>---------
>To unsubscribe, send email to <aklug-request@aklug.org>
>with 'unsubscribe' in the message body.
>

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Mon Aug 21 19:43:49 2006