inode, linking and unlinking

[n00bius]

Question, so hypothetically, you can unlink (delete) a file and the data isn't gone, just the filename (reference) to the inode number. I don't think it's too far fetched to think that a new filename reference could be made to link to that specific inode (assuming you know the number), ergo recovering the file.

also assuming that the inode hasn't been overwritten. and even better is there a way to do this in perl, (i.e. perl grabs through every unlinked inode and creates a link to it as a rough type of data recovery).

[SirDice]

How do you think recovery and forensic software work?
It's not hypothetical.. It's a given fact..

Before you start reinventing the wheel have a look at Sleuthkit/Autopsy.

http://www.sleuthkit.org/

[n00bius]

cool beans, i'll look into it, seems it'll be a job of understanding it enough to get it to do what i want it to do.

[nihil]

Hi, n00bius

I guess you are working on some sort of project here?

Might I also suggest looking at the clusters and what they still contain? I was playing with a recovery tool that does that, only the other day.

Like SirDice, I don't believe in reinventing wheels, given that my sole objective is to recover customers' or friends' data.