1 |
> photorec, from the testdisk package, will retrieve all files from a |
2 |
> filesystem, deleted or otherwise. However it doesn't retrieve the names |
3 |
> so finding the right one will be fun :-O Grep will help immensely. |
4 |
|
5 |
This implies that the new file data is not written over to the top of |
6 |
the old file - is that typically the case? Is it file system |
7 |
dependent? |
8 |
|
9 |
Is the file overwrite something like; |
10 |
- write new file data to spare blocks |
11 |
- move filename (hardlink) to point to the new block location |