File Recovery Techniques
By Wietse Venema, December 01, 2000
Wietse investigates the topic of file recovery by reconstructing past behavior and examining deleted file access time patterns and other attributes.
Dec00: File Recovery Techniques
Aug 04 16:00:14
85 m.c -rw-r--r-- wietse /home/wietse/hello.c (create source file)
Aug 04 16:00:21
<b> 1024 m.. drwxr-xr-x wietse /home/wietse</b>
4173 mac -rwxr-xr-x wietse /home/wietse/hello (create executable)
85 .a. -rw-r--r-- wietse /home/wietse/hello.c (read source file)
Figure 2: File access time patterns for compiling a "hello world" C program. The line in bold shows what information is left behind when the source and executable files are deleted. Access methods are indicated with m (write access), a (read or execute access), and c (attribute change).
