Today a little weird thing happened. I have moved some files that I’d download with KTorrent to a different location. And then I used the ‘move files’ feature from KTorrent to move them again (?).
Well, the error of ‘file doesn’t exist’ appeared (which was obvious since I have already moved them) but when I opened the directory were I’d moved the files, they were all GONE.
I have plenty of expertise in Computational Forensics to know that the files are already there, but I have never did this sort of (simple) recover on Linux, using EXT4 partition.
I tried sleuth kit and a lot of other recovering/forensics tools, but they just recover from whole disks or image files. None of them work with directories.
True.
My expertise on forensics is in reporting, data analysis, data recovering on FATx/NTFS systems and so on… Little expertise on EXTx systems specifically. But I solved the problem =D. Downloaded it all again -.-
I’ll do some work on EXT systems so that if I need again, It’ll be there. But as far as I know from now, it is virtually impossible to recover ONLY the deleted files, given that the partition journal is automagically changed when you delete a file… So you would need to scan the whole drive looking for files’ headers & signatures and recover them all…