Extracting trailing file data (slack)

1. extract the slack from the target file.
   bmap --slack target_file > file_slack
2. Done

Undeleting files

1. Determine byte offset of string with respect to beginning of block device containing filesystem
2. compute sector(s) containing string
3. generate inode sector lists exhaustively over the filesystem.
   find * -exec bmap {} >> /another_file_system/blocks \;
4. sort lists from step (4) into a single list.
   cat /another_file_system/blocks | sort -n | uniq > /another_file_system/blocks.sorted
5. identify the contiguous set of unallocated sectors surrounding the sectors from step (3).
6. extract the sector set identified in step (6).
7. Done