<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The Avid Coder</title>
	<atom:link href="http://www.theavidcoder.com/?feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://www.theavidcoder.com</link>
	<description>A blog about computers, programming, games, linux and everything geeky...</description>
	<lastBuildDate>Sun, 17 May 2009 21:53:59 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>Fallout 3 &#8211; The Most Fun You Can Have in a Post-Apocalyptic Wasteland?</title>
		<link>http://www.theavidcoder.com/?p=22</link>
		<comments>http://www.theavidcoder.com/?p=22#comments</comments>
		<pubDate>Sun, 17 May 2009 21:48:07 +0000</pubDate>
		<dc:creator>theavidcoder</dc:creator>
				<category><![CDATA[Game Reviews]]></category>
		<category><![CDATA[PC]]></category>
		<category><![CDATA[3d]]></category>
		<category><![CDATA[games]]></category>
		<category><![CDATA[reviews]]></category>

		<guid isPermaLink="false">http://www.theavidcoder.com/?p=22</guid>
		<description><![CDATA[I am not a fan of the original Fallout games. I suppose by the time I got around to playing it, too much time had passed since its release and comparing it to other games in terms of graphics and controls was just too tempting. I could never get used to the turn based action [...]]]></description>
			<content:encoded><![CDATA[<p>I am not a fan of the original Fallout games. I suppose by the time I got around to playing it, too much time had passed since its release and comparing it to other games in terms of graphics and controls was just too tempting. I could never get used to the turn based action point style of play: for me it somehow removed an element of fun and immersion from the games. So when I heard that Fallout 3 was officially in production I was not all that excited; that is until I heard that Bethesda were the ones developing it. Suddenly I started imagining the Fallout background and the post-nuclear-holocaust setting combined with the technology and gameplay behind Morrowind and Oblivion. Suddenly the tables were turned – Fallout 3 could turn out to be a great game.</p>
<p><span id="more-22"></span>Since I never completed the original Fallout games, some of my gamer friends feel that there is a very large, gaping hole in my gaming education. That may very well be, but in the case of Fallout 3 this might play to my advantage. The Fallout fans are pretty hardcore fans. They love “their” game and have always been extremely critical and demanding of any attempts to create a new game in the series. Fallout 3 may be spoiled for a hardcore Fallout fan on the smallest of issues (mainly inconsistencies with the previous titles, or the fact the Fallout 3 is full 3D or some such nonsense) where as someone who has not played the previous Fallout games will judge Fallout 3 purely by its own merit.</p>
<p>Fallout 3 has one of the more &#8230; colourful character creation sections that I&#8217;ve seen as of late. Basically you see the birth of your character in a first person perspective&#8230; As you are being born your father asks some questions or makes some statements. The answers to his questions or completions of his statements shape your character. After the birth section you play through some formative moments in your childhood in Vault 101. These include a birthday party where you receive your first PipBoy, your first work assignment and you get your first weapon.</p>
<p>The game really starts once you&#8217;ve completed the childhood sections. You&#8217;re character is woken up one evening by a long-time childhood friend, who informs you that your father has left the Vault. This is of course a massive breach in regulations and the Overseer wants to detain you for questioning. I don&#8217;t want to go into many more details about this, since the story of this game is best left to be explored by you, the player. Suffice it to say that from the beginning of the game you have quite a bit of freedom in the way you want to play. You can be good, evil or somewhere in between. You can follow the story mode or just explore the quite large and detailed world.</p>
<p>Fallout 3 is set in Washington D.C. The team at Bethesda did an excellent job at creating a post-apocalyptic metropolis with its surrounding suburbs and smaller towns. The world is richly populated, with more than enough areas to explore, adventure and enemies to fight.</p>
<p>Fighting, lets discuss that for a bit. Fallout 3 has a real-time combat system. Mostly you will prefer to fight from the first-person perspective with one of the many weapons that can be found in the world. Here the game plays a lot like your average first person shooter, with yourself and some enemies maybe being able to take a bit more fire than usual. The action point system of old is gone from the standard combat and has been converted into the new VATS system. The VATS system allows you to pause the game and target specific areas of an enemy. Obviously if you hit the enemy in the head it takes more damage than if you hit it in the torso, but it takes more accuracy to hit an enemy&#8217;s head. Also every action you perform in VATS costs action points. These points are replenished with each kill you make. Targeting the head generally costs more action points than targeting an arm or torso. After you have made your target selections and start firing in VATS, the action is shown is slow motion. This can lead to some very gory and bloody deaths for your enemies, or to frustration for you if your character keeps missing&#8230;</p>
<p>The difficulty level of the game adjusts as your character increases in level: this is to ensure a challenge throughout the game. Since the game is open ended one player might be 5 levels higher than another when you reach the end of the game, so such a system is important. Unfortunately, in my experience with the game at least, it lead to enemies that were always just slightly too weak. I would just fire up VATS for every single section of combat, and pick of the enemies one-by-one like shooting fish in a barrel. This definitely spoiled some of the fun for me.</p>
<p>In Fallout 3 you can also have one NPC henchman or ally. This is cool initially as it can help in some of the tougher combat scenarios you might find yourself in, when your character is still ill-equipped or at a fairly low level. Later, however, there is a certain NPC that is almost unstoppable. As soon as you have this guy following you, you just have to start a fight and then sit back: he will kill everyone, quickly. This diminishes quite a few of the challenges in the game.</p>
<p>Fallout 3 has such a large world with so many quests and stories to discover, that I cannot discuss even a tenth of them. Even though the scaling difficulty levels and NPC system are not that great, this is still a great game, with a good story (except for the ending, I hated that) that deserves some serious play time from real-time RPG fans and Fallout fans alike. I think it is probably close to the best Fallout 3 that could have been made and it is definitely a lot of fun to play.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.theavidcoder.com/?feed=rss2&amp;p=22</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Far Cry 2: Did Someone Misplace the Plot?</title>
		<link>http://www.theavidcoder.com/?p=12</link>
		<comments>http://www.theavidcoder.com/?p=12#comments</comments>
		<pubDate>Sun, 23 Nov 2008 19:08:38 +0000</pubDate>
		<dc:creator>theavidcoder</dc:creator>
				<category><![CDATA[Game Reviews]]></category>
		<category><![CDATA[PC]]></category>
		<category><![CDATA[3d]]></category>
		<category><![CDATA[games]]></category>
		<category><![CDATA[reviews]]></category>

		<guid isPermaLink="false">http://www.theavidcoder.com/?p=12</guid>
		<description><![CDATA[When I first heard that there was a sequel to Far Cry in the works I was very excited. I liked Far Cry, until the monsters came and the main character suddenly became some ghastly mutated being with feral powers. Then I heard that CryTek was not going to be developing Far Cry 2, but [...]]]></description>
			<content:encoded><![CDATA[<p>When I first heard that there was a sequel to Far Cry in the works I was very excited. I liked Far Cry, until the monsters came and the main character suddenly became some ghastly mutated being with feral powers. Then I heard that CryTek was not going to be developing Far Cry 2, but that it would instead be a team from Ubisoft. That caused my interest to wither a bit, but I kept an eye on the game nonetheless. When I saw the first videos of the game my interest was piqued once again. Seeing the game is set in Africa, and seeing how well they managed to recreate the African atmosphere made me very excited for the potential of the game. The combat shown in the videos also gave me the impression that this was going to be a strong shooter. Then the game was finally released, and with great anticipation I started to play it, but alas after a couple of hours I disappointedly quit the game, realising that the faults of the game outweighed its strengths.</p>
<p><span id="more-12"></span>Far Cry 2 is a visual masterpiece. The team at Ubisoft did an excellent job at recreating the African environment and atmosphere. The deserts, bush and jungles look amazing. The intro sequence of the game give you more than enough time and opportunity to take a gander at the beautiful environment. It is not only the flora of the African landscape that the team faithfully recreated, but also the fauna. More than once I raced through the bush at night, in one of the hundreds of Jeeps scattered through the world, dodging trees and rocks, only to collide with a grazing zebra. If you let the game grab your imagination you really do feel like you are in Africa (yes I do live in Africa).</p>
<p>The NPCs in the game also make out a large part of its atmosphere. They consist of locals, militia and some mercenaries. These characters speak to each other in English but also in African languages. What an utter joy it was the first time a mercenary taunted me in Afrikaans while I was fighting him. This level of detail, unfortunately, will only truly be appreciated by someone who speaks one of the African languages used in the game. But that is enough of the visual beauty and atmosphere of the game. Let us now move on to the really important aspects of any game: gameplay and story.</p>
<p>In the game you play a mercenary sent to kill a notorious arms dealer known only as the Jackal. Upon your arrival in the country things get a bit out of hand and you are thrown into the middle of a war between two rival factions, the UFLL and the APR. The Jackal supplies both factions with weapons, so in order to try and get close to him you have to do some missions for the factions.</p>
<p>The basic gameplay of Far Cry 2 is gun battles, gun battles and more gun battles with some rockets and grenades thrown into the mix and some exploding vehicles here and there. The weapons in the game (and there are plenty to choose from) are well designed and has faithful sound effects. The gun play itself is fun. One would then be tempted to say that this sounds like a great shooter, but one would be wrong. The game just has too many faults. Until now I have focussed on the good aspects of the game, now I shall start with the bad.</p>
<p>Weapons in Far Cry 2 deteriorate with use. Once you have a fired a couple of clips with a brand new weapon it suddenly starts to rust and becomes dirty (I never dropped it in the water, or dragged it through mud, I promise&#8230;). Once that happens the weapon will start to jam at least once per clip until it becomes, pretty much, utterly useless or just explodes. Of course no enemy in the game maintains any of his weapons so any weapon you pick up from a fallen enemy is always in a poor condition and is pretty much useless, but while they are using the weapons it hardly ever jams: this is just silly.</p>
<p>As far as acquiring new weapons go, you have to make use of the arms dealers scattered throughout the game world. At arms dealers you can buy new weapons (you then get an unlimited supply of these weapons at warehouses throughout the game world) with conflict diamonds, the main currency of the game. You earn diamonds by completing missions or by discovering some hidden cases throughout the world. Far Cry 2 has numerous weapon unlocks that you can acquire by completing some missions for the arms dealers. Unfortunately the missions are very unimaginative: it always involves the destroying a convoy, it is basically always exactly the same mission that just takes place somewhere else in the game world.</p>
<p>Another problem Far Cry 2 has is with its damage model with respect to enemies. Often while playing the game I would take my .50 calibre Desert Eagle and shoot a shirtless guy in the chest; he does not even flinch. I shoot him again, still to no avail: he is still going strong. I shoot him a third time, he then falls to the ground &#8230; but wait he is not dead, no he crawls around, draws his pistol (that has unlimited ammo) and starts shooting at me. I empty the remainder of my clip into him to make sure that he is dead, since this game does not seem to even try and get close to a logical damage model. I could understand enemies that are able to take some damage if the game had few enemies or sparse battles. But there are always numerous enemies in any battle, plus if you are not in a cease-fire zone you are always only something like twenty seconds from a fight.</p>
<p>Which brings me to another one of the big problems of Far Cry 2: almost everyone is always an enemy. Throughout the roads in the Far Cry 2 world there are guard posts belonging to one of the factions. There are also assault trucks patrolling a lot of the roads. These guards are always your enemy and they shoot you on sight. They can recognise that you are an enemy even if you are driving a vehicle reasonably far from such a post. You have to do a lot of driving in the game to accomplish your missions, so I think you can see where I am going with this: it becomes so irritating, infuriating, nauseating, and just plain boring to have to fight your way through guard post after guard post over and over and over and over again, just to get to your actual mission location, where there is another fifty guys waiting for you. It is not fun, it is just plain boring.</p>
<p>Lastly we come the most disappointing aspect of the game for me, and the one that I hinted to in the title of this post: the game pretty much has no story. Yes, I mentioned earlier that you are sent to kill some arms dealer called the Jackal. As it happens he supplies the in game factions with weapons, and to get close to him you have to do some work for the factions. Unfortunately no effort was made to let the player identify with any of the in game characters. Two thirds through the game I still did not know the names of the faction leaders, nor did I care any more, it was just so boring. The missions you do are completely disjoint with no real story unfolding. There are supposedly about thirty story missions, but only two or three feel like story missions.</p>
<p>Throughout the game you also encounter buddies. These are NPCs that are actually friendly toward you. You can do utterly pointless missions for them with no reward in back-story or character development: you never really learn about or identify with these characters either. They do, however, give you alternate ways of completing the story missions, and sometimes rescue you in tight battles, but the dialogue is all very generic and stiff, making you completely indifferent if anything bad should happen to them&#8230;</p>
<p>Far Cry 2 is a game that had mountains of potential, but in the end the only thing the developers seemed to focus on was the graphics and making it look authentic. Everything else, gameplay and story, took a back seat and we were left with an utterly mediocre game. I guess the real question is, is it fun? For the first couple of hours and for some mindless gun battles every now and again, yes. As a solid, complete game with strong gameplay and narrative? A thousand times no.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.theavidcoder.com/?feed=rss2&amp;p=12</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Spore: Revolutionary or Boring?</title>
		<link>http://www.theavidcoder.com/?p=8</link>
		<comments>http://www.theavidcoder.com/?p=8#comments</comments>
		<pubDate>Tue, 04 Nov 2008 10:04:13 +0000</pubDate>
		<dc:creator>theavidcoder</dc:creator>
				<category><![CDATA[Game Reviews]]></category>
		<category><![CDATA[PC]]></category>
		<category><![CDATA[3d]]></category>
		<category><![CDATA[games]]></category>
		<category><![CDATA[review]]></category>

		<guid isPermaLink="false">http://www.theavidcoder.com/?p=8</guid>
		<description><![CDATA[I had high hopes for Spore. After Will Wright&#8217;s success with The Sims and The Sims 2 and their respective collosal lists of expansion packs one cannot be blamed for suspecting that Will Wright knows a thing or two about making games. So when Spore was announced I immediately started paying attention. As more and [...]]]></description>
			<content:encoded><![CDATA[<p>I had high hopes for Spore. After Will Wright&#8217;s success with <em>The Sims</em> and <em>The Sims 2</em> and their respective collosal lists of expansion packs one cannot be blamed for suspecting that Will Wright knows a thing or two about making games. So when Spore was announced I immediately started paying attention. As more and more details emerged I became ever more excited about the game. A game about evolution? Interesting. You can create and shape the course of your creatures&#8217; evolution? Cool. The final phase will be a massive space-age where you can battle, ally and trade with other races? Wow, yes please. Then they announced what sounded like the gem that would complete this would-be crown of a game: your creations, those of your friends and every other player will be shared through an online service, free of charge. This means endless free content, every planet could be truly unique: populated with life created by countless individuals around the world! This is a game that sounds great on paper, and maybe it was great at some stage during its development as well. What we ended up with though is something that is only half of what we came to expect.</p>
<p><span id="more-8"></span>During your first play through of the game you play through five stages of the evolution of your creatures. The first stage is the cell stage where you basically muck about in the primordial soup. In Spore you can choose whether your creatures are herbivores, carnivores or omnivores. As a carnivore you can hunt other creatures, that is your primary source of food. As a herbivore you search for proper food sources floating about in the soup and obviously as an omnivore you can eat whatever you want. Based on your style of play the game also determines the general personality of your creatures. If you kill a lot of other creatures you are aggressive. If you make a lot of allies you are friendly and so forth. Unfortunately it is almost impossible to be a carnivore and be friendly, you have to kill to eat so ultimately you end with super aggressive militaristic creatures. If you are a herbivore you can kill, but why bother, it is easier to just eat and run away if there is any danger. So you mostly end up with super friendly creatures, although in the later stages you can shift your tactics to become more aggressive.</p>
<p>In the second stage, called the creature stage, your creatures evolve onto land. In this stage you must interact with other creatures. If you are a carnivore you have to hunt and kill other creatures since that is your primary source of food. If your creatures are herbivores or omnivores you can avoid the combat almost completely by eating fruit that is available throughout the world. This stage also introduces the first social contact between different species. To advance in the creature stage you either have to ally with other species or wipe them out. In order to ally with some creatures you play a game of monkey-see-monkey-do: your potential friends perform some dance or singing routine and you have to mimic it with your creature. Unforunately this is the most boring gameplay element I have ever seen and it becomes utterly infuriating after the third time you do it. Thus the depth of the creature phase: hunt or sing and dance. Oh yes, I almost forgot, you do pick up random body parts scattered around the world that you can then add to your creature everytime you breed.</p>
<p>The third phase is the tribal phase. The various species of creatures on your planet now have small villages. The goal in this phase is the same as in the previous phase: kill or befriend the other species. You can build some basic buildings to obtain weapons, or musical instruments to impress other tribes. You also gather food by hunting or fishing and have to protect it from theft by other tribes or wild creatures. Again, like the creature phase, there is no real depth here.</p>
<p>The fourth phase is the civilisation phase. Your single species has now evolved into the dominant species on the planet. The planet is populated with a number of cities and you start with one. In this phase you can design your structures much like you can create your own creatures. This is fairly interesting and in this phase you start to have some fun. Depending on where your city is located you can build land vehicles or sea vehicles. It is important to note that depending on your style of play through the earlier phases your nation can be either militaristic, economic or religous. A militaristic nation can construct combat vehicles and capture other cities by force. The religous type projects some religious hologram and converts the cities to their cause. The economic nation cannot construct combat vehicles, only trade vehicles (unless they capture militaristic cities) and must trade with other cities and eventually buy them. As you capture more and more cities you unlock some special abilities. As an example: the militaristic nation gets various rockets. One type basically captures cities instantly. The most advanced types allows you to beat the civilisation phase by basically blowing up all of the remaining enemy cities. As with the other phases when the civilisation phase comes to an end you are left wanting more. It does not really have much depth. As with the first three phases the civilastion phase can be played through very quickly. It seems that the intent of the first four stages is really to create your creature: you create the appearance and the personality of your creatures through your gameplay.</p>
<p>The fifth stage is the space stage. This is the stage that is supposed to truly make the game. In the space stage you can travel between planets and stars. You find other space-faring species among the stars that can become either friend or foe (except for those that are just immediately hostile, the first communication with them is something like: &#8220;Hi, we are going to destroy you now. Its nothing personal, if we don&#8217;t do it someone else will.&#8221;).</p>
<p>In the space stage relationships with other races generally follow the following trend: do some missions for them to become friends, trade with them, ally with them and then potentially get a ship from them to join your fleet. The missions they offer you are all very similar and basically involve flying to some planet and killing or abducting some creatures.</p>
<p>The space stage has quite a variety of items you can buy and trade. Among these are rare artifacts and artifact sets, weapons for your ship, spices mined on your colonies (spice trading is your primary source of income). Trading can become tiresome though, as you have to fly to numerous stars and planets to try and find good prices for your items, since almost everyone seems to try and cheat you or something.</p>
<p>An important task in the space stage is to expand your species&#8217; empire. This can be accomplished by trading with allies and then buying their planets, capturing enemy colonies by force or by terraforming and colonising planets yourself. The latter can be quite an expensive prospect as the equipment needed to properly terraform and colonise planets are &#8230; well, expensive.</p>
<p>If you have enemies in the space stage, or if any of your allies have enemies in the space stage your/their colonies will be attacked every so often (waaayy to frequently). This involves dropping what you are doing, racing over there and destroying the attackers. Then you have to visit each of your cities to rebuild any buildings that may have been destroyed in the attack. This can get a bit tedious and a city or planet governer that automatically rebuilds destroyed buildings could have been helpful.</p>
<p>This is very much a sandbox game and to some extent a social networking game. Some of the funniest and best moments I had in the game was seeing how a spaceship that one of my friends created visits my planet and abducts some of my creatures. In my game I found his creatures on a remote planet and I swooped in and abducted some of them (and dropped some of them to their deaths &#8230; by accident, really). But that is it. That is where it stops. You create a creature, its fun and exciting. You get to the space stage and start exploring a bit. Great. You find some of your friends&#8217; creations in your universe, and you hear stories of them finding some of your stuff. Cool and funny, but that is all. Don&#8217;t get me entirely wrong here, the game is not a total disaster, it is enjoyable the first time you play it. It is fun until a couple of hours into the space stage when you realise that the repetition is going to kill you.</p>
<p>Spore had the makings of an excellent game but it seems to have been dumbed down a bit along the way. Possibly the gameplay was simplified, the depth lessened, in order to appeal to a wider audience, I don&#8217;t know. I just know that this could have been a much better game than it turned out to be. I guess the ultimate question is, is it fun? Yes, for the first couple of hours at least.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.theavidcoder.com/?feed=rss2&amp;p=8</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to Recover Deleted Files from Ext3 Partitions</title>
		<link>http://www.theavidcoder.com/?p=3</link>
		<comments>http://www.theavidcoder.com/?p=3#comments</comments>
		<pubDate>Sun, 28 Sep 2008 18:59:28 +0000</pubDate>
		<dc:creator>theavidcoder</dc:creator>
				<category><![CDATA[File Recovery]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[command line]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[undelete]]></category>
		<category><![CDATA[unix]]></category>

		<guid isPermaLink="false">http://www.theavidcoder.com/?p=3</guid>
		<description><![CDATA[Well as the lengthy title of this article indicates, this will be my attempt to give an overview of how to recover deleted files from an Ext3 partition. First off let me say that it is not at all easy to recover deleted files from an Ext3 file system. If you are primarily a Microsoft [...]]]></description>
			<content:encoded><![CDATA[<p>Well as the lengthy title of this article indicates, this will be my attempt to give an overview of how to recover deleted files from an Ext3 partition. First off let me say that it is not at all easy to recover deleted files from an Ext3 file system. If you are primarily a Microsoft Windows user you might not even know what the Ext3 file system is and if you have any file recovery experience on the Windows platform you might also be asking yourself why I am making any fuss about deleted file recovery. After all on Windows it is mostly easy. You download some piece of software, like <a href="http://www.r-studio.com/" target="_blank">R-Studio NTFS</a>, and then you click here and there and its done. Some of you might recall recovering deleted files on an Ext2 file system. If so you will probably have noticed that it is not really much more complicated than recovering files on Windows. Unfortunately there is a <span class="Apple-style-span" style="font-weight: bold">big</span> difference in the way files are generally deleted on the Ext3 file system when compared to other file systems.</p>
<p><span id="more-3"></span>With the FAT or NTFS (with NTFS I am speaking under correction) when files are deleted they are simply marked as deleted in whatever data structure holds the primary file entries. No actual data of the file is overwritten until the operating system decides to do so, when you are copying new files on the partition, for instance. The very important thing here is that not all of the meta data pertaining to the deleted file is removed from the file allocation table (in the case of the FAT file system). Links to the location and size of a deleted file remain behind, even after it has been deleted. In the Ext2 file system the situation is similar.</p>
<p>The Ext file system consists of blocks, block groups, inodes and directory entries. Blocks are generally span a couple of consecutive sectors. A bunch of consecutive blocks form a block group. When a file is created it will be allocated all of the blocks that are needed to store the file. The OS will try to allocate the blocks and block groups of the file consecutively, but this will not always be possible. The meta-data of a file, the creation and modified time, size and pointers to blocks containing the actual data are stored in inodes. Inodes are found in the inode table located at the beginning of a block group. Lastly there are directory entries for all directories, listing the names of the files, and their associated inodes, that are stored in the directory. Directories in Ext file systems are handled much like files.</p>
<p>The difference between Ext2 and Ext3, when it comes to file deletion, is that when a file is deleted in Ext2 it also basically only marked as deleted. Its block groups are now free to be allocated to other files. The inode of the file still contains its size and the address of its start block. In the Ext3 file system the size and address fields in the inode of a file are cleared upon deletion. Thus there is no way to no exactly where the file starts or how large it is. Note that the entry for the file is still in the directory entry of its parent directory. Thus the filename is linked to the inode. So we can find the inode of the file, but we do not now its size nor its start block and other indirection blocks used to store addresses for blocks of the file. Using a tool called <span class="Apple-style-span" style="font-style: italic">debugfs </span>can find out what the inode of a deleted file is. We can also find out to what block group the inode belongs. To actually recover the file we must use a forensic analysis tool to analyse the raw data close to where the file was located (by reading all of the blocks in the block group of the inode of the file). A program called <span class="Apple-style-span" style="font-style: italic"><a href="http://foremost.sourceforge.net/" target="_blank">foremost</a> </span>is such a tool. It can scan data looking for header or start of file patterns of known file formats, such as JPEG or AVI. The difficulty with such a tool, despite the fact that it is time consuming, is that it not all file formats have specific end-of-file patterns. Thus the tool will not be able to easily detect when the file ends. Furthermore the tool must also be able to detect indirect blocks (blocks storing continuation addresses of fragmented files) while it is reading the potential file data and skip over it.</p>
<p>Let us look at an example. For this example we will use <a href="http://foremost.sourceforge.net/" target="_blank">Foremost</a> and <a href="http://www.sleuthkit.org/" target="_blank">The Sleuth Kit (TSK)</a>. We will delete an existing file called &#8216;test.jpg&#8217;. We delete the file and start by using <span class="Apple-style-span" style="font-style: italic">debufs</span> to find the inode of the file.</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span># debufs /dev/sda5</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>debugfs 1.41.1 (01-Sep-2008)</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>debugfs: cd /test</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>debugfs: ls -d</p>
<p>So what we do is run <span class="Apple-style-span" style="font-style: italic">debugfs</span> on the drive that we deleted the file from. Then we change to the directory that contained the deleted file using <span class="Apple-style-span" style="font-style: italic">debugfs</span>. Finally we execute the command <span class="Apple-style-span" style="font-style: italic">ls -d</span> in <span class="Apple-style-span" style="font-style: italic">debugfs. </span>This lists everything in the folder including the deleted files with their inodes. Deleted file inodes are displayed as &#8216;&lt;1234567&gt;&#8217;. In our case the inode of the file &#8216;test.jpg&#8217; is &lt;2835097&gt;. The next step is to find out to which block group the inodes belong. Once we have the block group number we can find the actual block range of the block group. Using the &#8216;imap&#8217; command in <span class="Apple-style-span" style="font-style: italic">debugfs</span> we can get some information about an inode, including the block group it belongs to:</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>debugfs: imap &lt;2835097&gt;</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>Inode 2835097 is part of block group 346</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>located at block 11337750, offset 0x0c00</p>
<p>So now we know that the block group containing our deleted file is block group 346. We can now use a tool called <span class="Apple-style-span" style="font-style: italic">fsstat,</span> from TSK, to determine the range of blocks that span block group 346:</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span># fsstat /dev/sda5</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>Group: 346:</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>Inode Range: 2834433-2842624</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>Block Range: 11337728-11370495</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span>&#8230;</p>
<p>Here we are interested in the block range. In this case it is 11337728-11370495. What we need to do now is write the contents of the unallocated blocks in the block range out to a file on another partition and then scan those blocks with foremost and hope it finds our file. We can write the blocks out using another tool from TSK called dls:</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span># dls /dev/sda5 11337728-11370495 &gt; /temp/recovery.dat</p>
<p>All that remains is to run <span class="Apple-style-span" style="font-style: italic">foremost</span> on the file /temp/recovery.dat and then we must hope that it finds our file:</p>
<p><span class="Apple-tab-span" style="white-space: pre"> </span># foremost -vd -t jpg -i /temp/recovery.dat -o /temp/output</p>
<p>Here I use the &#8216;-vd&#8217; flags to indicate that I want verbose output and that we are using a Unix-based file system. The next flag, &#8216;-t jpg&#8217;,  means that I am looking to extract JPEG files. The &#8216;-i /temp/recovery.dat&#8217; specifies the input file and &#8216;-o /temp/output&#8217; specifies the output file.</p>
<p>The process I have described works sometimes and sometimes it does not. It really depends quite a bit on if you have used the file system since you deleted the file or not, but sometimes we are just unlucky.</p>
<p>Luckily there is an open source set of scripts available that makes using tools like <span class="Apple-style-span" style="font-style: italic">debugfs</span> and <span class="Apple-style-span" style="font-style: italic">foremost</span> much simpler. <span class="Apple-style-span" style="color: #3366ff"><a href="http://projects.izzysoft.de/trac/ext3undel" target="_blank">Ext3Undel</a> </span>simplifies this process into two scripts: <span class="Apple-style-span" style="font-style: italic">ralf </span>and <span class="Apple-style-span" style="font-style: italic">gabi</span>. <span class="Apple-style-span" style="font-style: italic">Ralf</span> follows the process we described, it searches the local block group of an inode with a tool like <span class="Apple-style-span" style="font-style: italic">foremost</span> for a file type specified by the user. The user can give the file name and its parent directory with the file type as parameters and <span class="Apple-style-span" style="font-style: italic">ralf </span>will try and recover it. This often fails. In such situations the <span class="Apple-style-span" style="font-style: italic">gabi</span> script can be used. It is similar in that it also uses <span class="Apple-style-span" style="font-style: italic">foremost</span> to search for files of a specified type, the difference is that it searches the entire free space area of a partition and outputs all matching files to a specified target directory (must be on a different partition than the one you are trying to recover a file from).</p>
<p>Most of my knowledge regarding this is from the following article: <span class="Apple-style-span" style="color: #333333"><a href="http://linux.sys-con.com/node/117909" target="_blank">Why Recovering a Deleted Ext3 File is Difficult&#8230;</a><a href="http://linux.sys-con.com/node/117909" target="_blank"> </a></span> It is a bit more in-depth than what I discussed but the conclusion is the same: do not accidentally delete files on an Ext3 parition! If you do, do not write to the drive at all, and immediately try and recover the file. If it is a small file you should be able to get it back. If the file is large you will probably get a corrupted version back or you will not be able to get it back at all.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.theavidcoder.com/?feed=rss2&amp;p=3</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
