Brian Carrier has authored several leading computer forensic tools, including The Sleuth Kit (formerly The @stake Sleuth Kit) and the Autopsy Forensic Browser. He has authored several peer-reviewed conference and journal papers and has created publicly available testing images for forensic tools. Currently pursuing a Ph.D. in Computer Science and Digital Forensics at Purdue University, he is also a research assistant at the Center for Education and Research in Information Assurance and Security (CERIAS) there. He formerly served as a research scientist at @stake and as the lead for the @stake Response Team and Digital Forensic Labs. Carrier has taught forensics, incident response, and file systems at SANS, FIRST, the @stake Academy, and SEARCH. He is the author of File System Forensic Analysis (Addison-Wesley, ISBN 0321268172).
We have all done it before. You accidentally type in the wrong argument to rm
or select the wrong file for deletion. As you hit enter, you notice your
mistake and your stomach drops. You reach for the backup of the system and
realize that there isn't one.
There are many undelete tools for FAT and NTFS file systems, but there are
few for Ext3, which is currently the default file system for most Linux
distributions. This is because of the way that Ext3 files are deleted.
Crucial information that stores where the file content is located is cleared
during the deletion process.
In this article, we take a low-level look at why recovery is difficult and
look at some approaches that are sometimes effective. We will use some open
source tools for the recovery, but the techniques... (more)
Brian Carrier has authored several leading computer forensic tools, including The Sleuth Kit (formerly The @stake Sleuth Kit) and the Autopsy Forensic Browser. He has authored several peer-reviewed conference and journal papers and has created publicly available testing images for forensic tools. Currently pursuing a Ph.D. in Computer Science and Digital Forensics at Purdue University, he is also a research assistant at the Center for Education and Research in Information Assurance and Security
Bob Snyder
Jacques Durand
Alf Pilgrim
Per Sjofors
Kirsten Lytsen
Data Recovery Services
Colin Armitage
