"Steven M. Bellovin" <smb@cs.columbia.edu> wrote:
> On Thu, 29 Mar 2007 12:25:17 +0000
[snip]
> > AFAIU files cannot be recovered because most of data from inodes
> > is flushed
> 
> You may want to look at http://www.porcupine.org/forensics/tct.html and
> Chapter 4 of http://www.porcupine.org/forensics/forensic-discovery/

Thanks for the pointers. Looks like what I've proposed. But seems
that NetBSD drops block references...

--
Mishka.