On Mon, Aug 3, 2009 at 6:19 PM, ranjith kannikara<ranjithkannikara@xxxxxxxxx> wrote: > Hi, > > We are doing a project to make an applicatio that can recover the deleted > data from an ext3 filesystem <http://sourceforge.net/projects/recoverext3/>. > We ahve used the tools foremost and debugfs to debug the filesystem and read > the journal. > Is there any way to read the journal? > Or How can we read the journal of a filesystem. > The inode number of the journal is present in the ext3_super_block > structure. But We are able to open the inode only with the help of these > tools. > Can someone guide us to where tio find the details of how a journal can be > read. Try http://www.sans.org/reading_room/whitepapers/forensics/taking_advantage_of_ext3_journaling_file_system_in_a_forensic_investigation_2011 I read that a bit just to understand the basic concept of ext3 journal....so I can not give insightful comment. Hopefully it is really useful for you. -- regards, Mulyadi Santosa Freelance Linux trainer blog: the-hydra.blogspot.com -- To unsubscribe from this list: send an email with "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx Please read the FAQ at http://kernelnewbies.org/FAQ
