Undeleted: Carving Tools Help You Recover Deleted Files

Jul 24, 2008, 19:05 (0 Talkback[s])
(Other stories by Ralph Spenneberg)

"In the past, recovery experts could easily retrieve a lost file because an earlier generation of filesystems simply deleted the directory entry. The meta information that described the physical location of the data on the disk was preserved, and tools like The Coroner's Toolkit (TCT [1]) and The Sleuth Kit (TSK [2]) could uncover the information necessary for restoring the file. Today, many filesystems delete the full set of meta information, leaving the data blocks. Putting these pieces together correctly is called file carving – forensic experts carve the raw data off the disk and reconstruct the files from it."

Complete Story

Related Stories:

• Linux Tool Speeds Up Computer Forensics for Cops(Mar 09, 2008)
• Computer Forensics: Linux Style!(Oct 16, 2007)
• Computerworld Singapore: Doing Data Forensics Right with Linux(Aug 24, 2005)
• NewsForge: The Two-Edged Sword: Legal Computer Forensics and Open Source(Apr 13, 2005)