On Wed, Jun 25, 2008 at 12:47 PM, "Stanisław T. Findeisen"
<[EMAIL PROTECTED]> wrote:
> Hello!
>
> What is the block assignment algorithm used in ext3 filesystem when creating
> a Big File?
>
> I recently deleted a 2GB .tgz file, and I am trying to restore it. I don't
> seem to have the block numbers. So maybe I could find the first block and
> try to guess the remaining ones, or so....
>
> That was a / partition in Fedora, so perhaps there were not that many
> deletions since system install...
>
> STF
> http://eisenbits.com/~stf/
If it is worth spending some money on:
1) Make an image of the entire partition that you are trying to
recover the file from.
dd if=/dev/sdXY of=/path-to-image-file.
Obviously the image-file may be very large, so you need to have lots
of freespace on your destination drive. I would recommend booting
from a LiveCD (or rescue CD) and connecting up an external USB drive
to hold the image.
2) Use read only tools to recover the file from that image. I'm sure
there are free ones, but a rather expensive commercial one is X-Ways
Forensics.
Even if you end up piecing this together by hand, working off the
image will ensure you don't overwrite your data in the process of
trying to recover it.
HTH
Greg
--
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf
The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com
