on disc structure of journal file in ext3

ajay.talk · 10-31-2007, 08:20 AM

hi
can someone explain me on disc structure of journal file in ext3.
i want to find out a deleted file through journal,but i don't know
about the structure of journal file.i am using winhex 14.3.
thanks in advance.

unSpawn · 11-01-2007, 06:25 PM

Quote:

Originally Posted by ajay.talk

can someone explain me on disc structure of journal file in ext3.

Find a copy of "Understanding the Linux Kernel, 3rd Edition", Chapter 18, The Ext2 and Ext3 Filesystems?

Quote:

Originally Posted by ajay.talk

i want to find out a deleted file through journal

Reading the above should show you the chance of successfully recovering the deleted file in full and from within the .journal is highly unlikely. Any details of what you're trying to recover and your forensics approach are welcome.

ajay.talk · 11-02-2007, 01:35 AM

where can i download this book?

SqdnGuns · 11-02-2007, 01:45 AM

Quote:

Originally Posted by ajay.talk

where can i download this book?

Buy it:

http://www.oreilly.com/catalog/understandlk/