Forensic: extundelete

Install

apt -y install extundelete

Percobaan

mkfs.ext3 /dev/sdb1

Mount

mkdir /mnt/percobaan
mount /devsdb1 /mnt/percobaan

Copy/buat file

 cp file.txt /mnt/percobaan
 cp file.jpeg /mnt/percobaan

Delete

 rm /mnt/percobaan/*

Restore

 umount /mnt/percobaan
 extundelete /dev/sdb1 --restore-all

Hasilnya akan disimpan di current directory dengan folder

RECOVERD_FILES