search for: tctutils

...and hook them up to another system. > > 3) Mount the filesystem(s) read-only. > > 4) Download and compile The Coroner's Toolkit, which contains a couple > of utilities you will need: unrm and lazarus. You can get TCT at: > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > interface for TCT. > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > I did this a few years ago and it works, but it will probably take you > many many hours to do a re...

...t; > 3) Mount the filesystem(s) read-only. > > > > > > 4) Download and compile The Coroner's Toolkit, which contains a couple > > > of utilities you will need: unrm and lazarus. You can get TCT at: > > > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > > > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > > > interface for TCT. > > > > > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > > > > > I did this a few years ago and it works, b...