debugfs 
http://www.netsec.si/tutorials/debugfs.html

If the disk is not very full and the files are small
and easily identifiable you might try foremost.sf.net or the 
Coroner's Toolkit (http://www.porcupine.org/forensics/tct.html)


Matt

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Reply via email to