January 10th, 2008, 09:02 PM
inode, linking and unlinking
Question, so hypothetically, you can unlink (delete) a file and the data isn't gone, just the filename (reference) to the inode number. I don't think it's too far fetched to think that a new filename reference could be made to link to that specific inode (assuming you know the number), ergo recovering the file.
also assuming that the inode hasn't been overwritten. and even better is there a way to do this in perl, (i.e. perl grabs through every unlinked inode and creates a link to it as a rough type of data recovery).
January 11th, 2008, 02:58 PM
How do you think recovery and forensic software work?
It's not hypothetical.. It's a given fact..
Before you start reinventing the wheel have a look at Sleuthkit/Autopsy.
Last edited by SirDice; January 11th, 2008 at 03:01 PM.
Experience is something you don't get until just after you need it.
January 16th, 2008, 05:20 PM
cool beans, i'll look into it, seems it'll be a job of understanding it enough to get it to do what i want it to do.
January 16th, 2008, 05:36 PM
I guess you are working on some sort of project here?
Might I also suggest looking at the clusters and what they still contain? I was playing with a recovery tool that does that, only the other day.
Like SirDice, I don't believe in reinventing wheels, given that my sole objective is to recover customers' or friends' data.