PaulDotCom mailing list archives

foremost and data forensics

From: monkeywebdaemon at googlemail.com (Monkey Daemon)
Date: Mon, 18 Jan 2010 19:57:56 +0000

Hi all,

I've been asked to search a computer for files that have been deleted recently.

As far as I am aware the disks have not been wiped (the directory
structure appears to be intact) and there is no need for this to pbe
presented in a court of law.

I've looked at foremost and it appears to only apply to a given partition.

As I am only interested in a particular directory and the disk partion
that the directory resides on is an ext3 LVM volume, are there any
risks in using foremost to recover this data?

Kind regards,

MWD

Current thread:

foremost and data forensics Monkey Daemon (Jan 18)
- foremost and data forensics Tim Krabec (Jan 18)
  - foremost and data forensics Monkey Daemon (Jan 19)
    - foremost and data forensics Tim Krabec (Jan 19)
    - foremost and data forensics Carlos Ayala (Jan 19)
    - foremost and data forensics Matt Erasmus (Jan 19)
    - foremost and data forensics Michael Miller (Jan 19)
    - foremost and data forensics Jim Halfpenny (Jan 19)