thanks for all those helpful suggestions. Just an update on where I am at with this.
ext2 and 3 inodes are similar, if not identical. they contain a list of blocks in the file (thats a simplification, if there are more than 12 blocks, the 13th item in the block list points to a block containing a list of pointers to further blocks, and if thats not enough it gets slightly more complex again, those details are not relevant to the point I am about to make). I have discovered that unlike ext 2, deleting a file in ext3 zeroes out all of the block list. ie in ext2, if you can find the inode, you can find the block list and recover the blocks using a disk editor or the recover program, or mc, or debugfs, or a combination). however in ext3 the block list is zeroed and unrecoverable. Therefore you have to use a disk editor to find and recover the right blocks. tricky. all the files i want are jpegs with exif headers, ie at byte 6 the string "exif' appears. Its easy to find the first block of each file. I have had some luck with then assuming the next X blocks are contiguous, but thats not always valid. LDE is a reasonable disk editor - any other suggestions as to disk editors or methodology? -- Nick Rout <[EMAIL PROTECTED]>
