[ale] recovering an ext3 drive

[jonathan at xcorps.net (Jonathan Rickman)]

On 20 Jan 2003, Mike Lockhart wrote:

> Hrm, this thread did go off topic, but then what would be the point of
> the ALE list if it didn't? ;)
>
> My home directory (/home/mike) had all sorts of crap in it, mp3's, text
> files, images, mail files, and so forth.
>
> I tried a program called gpart to see if it could recover the data by
> recovering/rewriting the partition tables, no luck there, and I probably
> won't have time to work on the drive this week, though I plan on getting
> back to it this weekend.
>
> I'm going to do a lot of reasearch this week, see where things go this
> weekend, and if all goes well and I get my data back, probably write up
> a case study and post it on my site to help people who encounter similar
> issues like I have.  We'll see what happens.  I'll keep you all posted.

Start your research here...

http://www.porcupine.org/forensics/tct.html

and here...

http://atstake.com/research/tools/forensic/

Enjoy.


--
Jonathan Rickman
X Corps Security
http://www.xcorps.net

_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale