On Wed, Jun 25, 2008 at 12:47 PM, "Stanisław T. Findeisen"<sf181257@xxxxxxxxxxxxxxxxxxxxx> wrote:> Hello!>> What is the block assignment algorithm used in ext3 filesystem when creating> a Big File?>> I recently deleted a 2GB .tgz file, and I am trying to restore it. I don't> seem to have the block numbers. So maybe I could find the first block and> try to guess the remaining ones, or so....>> That was a / partition in Fedora, so perhaps there were not that many> deletions since system install...>> STF> http://eisenbits.com/~stf/ If it is worth spending some money on: 1) Make an image of the entire partition that you are trying torecover the file from. dd if=/dev/sdXY of=/path-to-image-file. Obviously the image-file may be very large, so you need to have lotsof freespace on your destination drive. I would recommend bootingfrom a LiveCD (or rescue CD) and connecting up an external USB driveto hold the image. 2) Use read only tools to recover the file from that image. I'm surethere are free ones, but a rather expensive commercial one is X-WaysForensics. Even if you end up piecing this together by hand, working off theimage will ensure you don't overwrite your data in the process oftrying to recover it. HTHGreg-- Greg FreemyerLitigation Triage Solutions Specialisthttp://www.linkedin.com/in/gregfreemyerFirst 99 Days Litigation White Paper -http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf The Norcross GroupThe Intersection of Evidence & Technologyhttp://www.norcrossgroup.com˙ôčş{.nÇ+?ˇ?Ž??+%?Ë˙ąéÝjwŚj)p?Ř˙ş{.nÇ+?ˇ¤zšŢ?w°n'ŹţÚ qŞí?Ďç?ůb?ě˙˘¸?ćŹzˇ?vŘ^śm§˙˙?ęçzYŢÁ¸?łú+?ń@
