Undeleted: Carving Tools Help You Recover Deleted Files

"In the past, recovery experts could easily retrieve a lost file because an earlier generation of filesystems simply deleted the directory entry. The meta information that described the physical location of the data on the disk was preserved, and tools like The Coroner's Toolkit (TCT [1]) and The Sleuth Kit (TSK [2]) could uncover the information necessary for restoring the file. Today, many filesystems delete the full set of meta information, leaving the data blocks. Putting these pieces together correctly is called file carving – forensic experts carve the raw data off the disk and reconstruct the files from it."

Complete Story

Related Stories:

• Linux Tool Speeds Up Computer Forensics for Cops(Mar 08, 2008)
• Computer Forensics: Linux Style!(Oct 15, 2007)
• Computerworld Singapore: Doing Data Forensics Right with Linux(Aug 24, 2005)
• NewsForge: The Two-Edged Sword: Legal Computer Forensics and Open Source(Apr 13, 2005)