Foremost and Scalpel are not interested in the underlying filesystem. They simply expect the data blocks of the files to reside sequentially in the image under investigation. The tools will find images in dd dumps, RAM dumps, or swap files.Carving will help to identify and reconstruct files on corrupt filesystems, in
slack space, or even after installation of a new operating system, as long as the required data blocks still exist.
(...)
Read the rest of Recover Deleted Files with Foremost,scalpel in Ubuntu (751 words)
© admin for Ubuntu Geek, 2008. |
Permalink |
One comment |
Add to
del.icio.us
digg
Who's linking ?
Technorati
BlogPulse
Google
Want more on these topics ? Browse the archive of posts filed under Backup.
Ubuntu: Ubuntu Geek - Ubuntu Tutorials,Howto's,Tips and Tricks
Debian: Debian Admin Step By Step Tutorials and articles with screenshots
Data
syntax
recover
WITH
Using
command
Examples
backup
Debian
dd