I've read in several places that when you use dd to image a hard drive, it makes a byte-exact image which will even include the data from files that were recently deleted, but not yet overwritten by newer files.
I found something online about how to undelete files from ext2 file systems, and that for non-ext2 file systems you can run this command on the unmounted drive to try to recover some data from a deleted file:
However, that assumes that you know something about the deleted file. Is there a way (preferrably filesystem-independent) for reading through a hard drive's data (or the data of a dd image) and come up with a list of all the files that were deleted?
On Windows there were some undelete programs that would scan the hard drive and, in most cases, be able to find the file names of the deleted files and give you an estimate of how likely it is that the file can be recovered. How would you do this on Linux?
-------------
Cuvou.com | My personal homepage
Project Fearless | My web blog
I found something online about how to undelete files from ext2 file systems, and that for non-ext2 file systems you can run this command on the unmounted drive to try to recover some data from a deleted file:
Code:
grep -a -B[size before] -A[size after] 'text' /dev/[your_partition]However, that assumes that you know something about the deleted file. Is there a way (preferrably filesystem-independent) for reading through a hard drive's data (or the data of a dd image) and come up with a list of all the files that were deleted?
On Windows there were some undelete programs that would scan the hard drive and, in most cases, be able to find the file names of the deleted files and give you an estimate of how likely it is that the file can be recovered. How would you do this on Linux?
-------------
Cuvou.com | My personal homepage
Project Fearless | My web blog
