File Recovery Techniques
By Wietse Venema, December 01, 2000
Wietse investigates the topic of file recovery by reconstructing past behavior and examining deleted file access time patterns and other attributes.
Dec00: File Recovery Techniques
Aug 04 16:13:08
<b> 85 m.. -rw-r--r-- wietse <hda6-311549> (create source file)</b>
Aug 04 16:13:16
10897 mac -rw-r--r-- wietse <hda1-2022> (compiler temp file)
301 mac -rw-r--r-- wietse <hda1-2023> (compiler temp file)
872 mac -rw-r--r-- wietse <hda1-2024> (compiler temp file)
<b> 85 .a. -rw-r--r-- wietse <hda6-311549> (read source file)
4173 m.. -rwxr-xr-x wietse <hda6-311550> (create executable)</b>
Aug 04 16:13:22
<b> 4173 .a. -rwxr-xr-x wietse <hda6-311550> (run executable)</b>
Aug 04 16:13:28
<b> 1024 m.. drwxr-xr-x wietse /home/wietse </b>
<b> 85 ..c -rw-r--r-- wietse <hda6-311549> (delete source file)
4173 ..c -rwxr-xr-x wietse <hda6-311550> (delete executable)
</b>
Figure 4: Access time patterns for existing and deleted files after creating, compiling, running, and removing a "hello world" C program in Wietse's directory. Deleted files are represented by disk name and by file inode numbers. Only information in bold is likely to survive for an appreciable amount of time. Access methods are indicated with m (write access), a (read or execute access), and c (attribute change).
Back to Article | Sidebar
