2008/6/25 Greg Freemyer <greg.freemyer@xxxxxxxxx>:> On Wed, Jun 25, 2008 at 12:47 PM, "Stanisław T. Findeisen"> <sf181257@xxxxxxxxxxxxxxxxxxxxx> wrote:>> Hello!>>>> What is the block assignment algorithm used in ext3 filesystem when creating>> a Big File?>>>> I recently deleted a 2GB .tgz file, and I am trying to restore it. I don't>> seem to have the block numbers. So maybe I could find the first block and>> try to guess the remaining ones, or so....>>>> That was a / partition in Fedora, so perhaps there were not that many>> deletions since system install... First create a backup image of your disk using dd and then searchgoogle for "carlo wood + ext3grep" Hope that helps >>>> STF>> http://eisenbits.com/~stf/>> If it is worth spending some money on:>> 1) Make an image of the entire partition that you are trying to> recover the file from.> dd if=/dev/sdXY of=/path-to-image-file.>> Obviously the image-file may be very large, so you need to have lots> of freespace on your destination drive. I would recommend booting> from a LiveCD (or rescue CD) and connecting up an external USB drive> to hold the image.>> 2) Use read only tools to recover the file from that image. I'm sure> there are free ones, but a rather expensive commercial one is X-Ways> Forensics.>> Even if you end up piecing this together by hand, working off the> image will ensure you don't overwrite your data in the process of> trying to recover it.>> HTH> Greg> --> Greg Freemyer> Litigation Triage Solutions Specialist> http://www.linkedin.com/in/gregfreemyer> First 99 Days Litigation White Paper -> http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf>> The Norcross Group> The Intersection of Evidence & Technology> http://www.norcrossgroup.com>˙ôčş{.nÇ+?ˇ?Ž??+%?Ë˙ąéÝjwŚj)p?Ř˙ş{.nÇ+?ˇ¤zšŢ?w°n'ŹţÚ qŞí?Ďç?ůb?ě˙˘¸?ćŹzˇ?vŘ^śm§˙˙?ęçzYŢÁ¸?łú+?ń@
