The ext3 file system
Today we talked about ext3, and, in particular, the journal. We also talked about how it can be used in forensics. Please check out this paper for a good discussion. SANS Institute InfoSec Reading Room: Taking advantage of Ext3 journaling file system in a forensic investigation