I have an ext3 image that I am working on for school. I am trying to identify all deleted files and folders, including the full path names and inode numbers of these files/folders. I believe I need to use the blkcat command but I am unsure of the parameters that I need?
Can you speak with the dead?
Almost the same it is happening with deleted files... Pretty much impossible. When a file is deleted, it's simply gone. On most systems, this is not logged anywhere.
If you're using
If you deleted files using a GUI tool, they may still be in some kind of "trash can". It depends on what you're using for a desktop environment.
If you are interested to recover deleted files, maybe the following Q&A can help you:
Nevertheless, there is a tool called
to log the deleted files from
It sounds like you are talking about the forensic tools from The Sleuth Kit (TKS). There is a