Deleted files on a dir

Hey guys!

Today a little weird thing happened. I have moved some files that I’d download with KTorrent to a different location. And then I used the ‘move files’ feature from KTorrent to move them again (?).

Well, the error of ‘file doesn’t exist’ appeared (which was obvious since I have already moved them) but when I opened the directory were I’d moved the files, they were all GONE.

I have plenty of expertise in Computational Forensics to know that the files are already there, but I have never did this sort of (simple) recover on Linux, using EXT4 partition.

I tried sleuth kit and a lot of other recovering/forensics tools, but they just recover from whole disks or image files. None of them work with directories.

Does any one have any thoughts on this?


****… reading about ext4.

Seems not possible to me without doing some sort of full disk scan

i’ll give a try on Hiren’s boot cd… I post the results later

Mmm not sure that has any ext4 tools,as for not possible without a full disc scan highly likely.

Not sure on the specifics but on ext3 I’ve played briefly with ext3grep with some googling looks like this might do it. extundelete: An ext3 and ext4 file undeletion utility

Also gives you several other lower level options, but with hindsight, backups may well become the norm, if the data is valuable.

biduzido wrote:
> I have plenty of expertise in Computational Forensics to know

how much of that experience is with file systems like fat, msdos,
fat32 and ntfs, and how much with file systems like ext2, ext3, ext4,
and reiserfs…

some experience is not useful in all situations…

DenverD (Linux Counter 282315)
posted via NNTP w/TBird | KDE 3.5.7 | openSUSE 10.3 SMP i686
AMD Athlon 1 GB RAM | GeForce FX 5500 | ASRock K8Upgrade-760GX |
CMedia 9761 AC’97 Audio

My expertise on forensics is in reporting, data analysis, data recovering on FATx/NTFS systems and so on… Little expertise on EXTx systems specifically. But I solved the problem =D. Downloaded it all again -.-

I’ll do some work on EXT systems so that if I need again, It’ll be there. But as far as I know from now, it is virtually impossible to recover ONLY the deleted files, given that the partition journal is automagically changed when you delete a file… So you would need to scan the whole drive looking for files’ headers & signatures and recover them all…