On 8/16/07, Cristea Bogdan [EMAIL PROTECTED] wrote:
Is there a way to recover deleted files on ext3 partition? A quick search on
the Internet gives a negative response, however there are some nonfree
software that seem to be able to do that. So it can be done or not?
It can be done.
We use non-free software, but I suspect there is free software as well
FYI: ext3 uses basically the same on disk structure as ext2, so you
may have better luck searching for ext2 tools.
FYI2: The safest thing is to work from a dd clone of the partition
with the lost files.
ie. dd if=/dev/hda1 of=image_file bs=4k conv=noerror,sync
The paid for tools like XWays Forensics and Encase Forensics can then
open the image_file and find deleted files.
For the free tools, I don't know, but if not you have the image_file
as a backup and can restore it if need be.
Greg
--
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
The Norcross Group
The Intersection of Evidence Technology
http://www.norcrossgroup.com
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
