cgsecurity.org

Hi,

I have successfully undeleted a large number of text files. In order to identify the file without the filename I will need a reference date for modification, creation, etc. Unfortunately this information is not retained by default by Photorec as evidenced by the 'stat' command run on a file. However, I can recover this date information if I have the corresponding inode (using istat).

Does anyone know how to dump the inode number to the filename or a log when undeleting a file? Is this an option in photorec?

Or

Is it possible to keep a file's metadata (date of access, modification, etc) when undeleting?

Thanks for any advice!

TestDisk can recover files with their metadata (filenames, creation time) from FAT, NTFS, ext2, exFAT filesystem.
PhotoRec bypasses all file structure and only searches raw data (To be correct, there is an exception for FAT unformat that can be activated in Expert mode)

Unfortunately, the filesystem I am working with is ext3. Unless I am mistaken, TestDisk cannot recover files with their metadata from this type of filesystem. Is that correct? Thanks!

Hi @mrtruji, i have a similar problem, did you resolve it ?

Thank you.