inode, linking and unlinking
Results 1 to 4 of 4

Thread: inode, linking and unlinking

  1. #1
    Member n00bius's Avatar
    Join Date
    Mar 2005
    Location
    texas
    Posts
    86

    Thumbs up inode, linking and unlinking

    Question, so hypothetically, you can unlink (delete) a file and the data isn't gone, just the filename (reference) to the inode number. I don't think it's too far fetched to think that a new filename reference could be made to link to that specific inode (assuming you know the number), ergo recovering the file.

    also assuming that the inode hasn't been overwritten. and even better is there a way to do this in perl, (i.e. perl grabs through every unlinked inode and creates a link to it as a rough type of data recovery).
    ...:::Pure Kn0wledge:::...

  2. #2
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    How do you think recovery and forensic software work?
    It's not hypothetical.. It's a given fact..

    Before you start reinventing the wheel have a look at Sleuthkit/Autopsy.

    http://www.sleuthkit.org/
    Last edited by SirDice; January 11th, 2008 at 04:01 PM.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  3. #3
    Member n00bius's Avatar
    Join Date
    Mar 2005
    Location
    texas
    Posts
    86
    cool beans, i'll look into it, seems it'll be a job of understanding it enough to get it to do what i want it to do.
    ...:::Pure Kn0wledge:::...

  4. #4
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hi, n00bius

    I guess you are working on some sort of project here?

    Might I also suggest looking at the clusters and what they still contain? I was playing with a recovery tool that does that, only the other day.

    Like SirDice, I don't believe in reinventing wheels, given that my sole objective is to recover customers' or friends' data.


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •