[Leaplist] Can a deleted file be recovered on one's personal computer?

Sat Jan 2 12:03:54 EST 2010

On Saturday 02 January 2010 10:53:40 am Hank Lambert wrote:
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <html>
> <head>
>   <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
> </head>
> <body bgcolor="#ffffff" text="#000000">
> A deleted file is still on the hard drive until it is overwritten. When
> you deleted the file, you are not actually removing it from your drive,
> you are removing the pointers to it. If the file has not been
> overwritten, it can be recovered unless it is in the root directory.
> Root directory files cannot be recovered in this manner because you
> need to unmount the directory that contains the file you deleted, and
> the root directory is always mounted.<br>
> <br>
> 1) Unmount the directory that held the file.<br>
> 2) From the CLI, run debugfs against the directory, such as "debug
> /home/william/Desktop" (without the quotes) if the file was on your
> desktop.<br>
> 3) From the CLI, run lsdel. This creates a list of all files that have
> been deleted.<br>
> 4) Once you find the file, type dump <i>filename </i>where filename
> is the name of the file. This will put the file in the directory you
> are working from.<br>

Interesting.  That's probably been the most requested feature for ext2/3 
forever.

You can also use a tool called foremost to attempt to recover the raw data if 
it can no longer be recovered as part of the filesystem proper.

Description: Forensics application to recover data
 This is a console program to recover files based on their headers and footers
 for forensics purposes.
 .
 Foremost can work on disk image files, such as those generated by dd,
 Safeback, Encase, etc, or directly on a drive. The headers and footers are
 specified by a configuration file, so you can pick and choose which headers
 you want to look for.
Homepage: http://foremost.sourceforge.net/

One of the last ways you'd try to recover if you needed some of the data 
back...

-- 

Push Back: I am a citizen, not a "consumer".

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.