2008/6/25 Greg Freemyer <[EMAIL PROTECTED]>: > On Wed, Jun 25, 2008 at 12:47 PM, "Stanisław T. Findeisen" > <[EMAIL PROTECTED]> wrote: >> Hello! >> >> What is the block assignment algorithm used in ext3 filesystem when creating >> a Big File? >> >> I recently deleted a 2GB .tgz file, and I am trying to restore it. I don't >> seem to have the block numbers. So maybe I could find the first block and >> try to guess the remaining ones, or so.... >> >> That was a / partition in Fedora, so perhaps there were not that many >> deletions since system install...
First create a backup image of your disk using dd and then search google for "carlo wood + ext3grep" Hope that helps >> >> STF >> http://eisenbits.com/~stf/ > > If it is worth spending some money on: > > 1) Make an image of the entire partition that you are trying to > recover the file from. > dd if=/dev/sdXY of=/path-to-image-file. > > Obviously the image-file may be very large, so you need to have lots > of freespace on your destination drive. I would recommend booting > from a LiveCD (or rescue CD) and connecting up an external USB drive > to hold the image. > > 2) Use read only tools to recover the file from that image. I'm sure > there are free ones, but a rather expensive commercial one is X-Ways > Forensics. > > Even if you end up piecing this together by hand, working off the > image will ensure you don't overwrite your data in the process of > trying to recover it. > > HTH > Greg > -- > Greg Freemyer > Litigation Triage Solutions Specialist > http://www.linkedin.com/in/gregfreemyer > First 99 Days Litigation White Paper - > http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf > > The Norcross Group > The Intersection of Evidence & Technology > http://www.norcrossgroup.com >
