deleted files are empty?

Benjamin Morin <[email protected]> Mon, 08 Dec 2003 15:27:31 +0100

Newsgroups	gmane.comp.security.forensics.tct
Organization	France Telecom R&D
Message-ID	<[email protected]>

Hello,

A [stupid] user has rm -rfed a directory. I've unmounted the disk
immediatly, then remounted-it read only. I have tried to recover the
deleted files using icat, but ils tells me that all the deleted files
are empty (size=0). The box is a Solaris 8, and the file system is ufs.
Any idea?

Thanks

Benjamin Morin