The check that never checked a file. Reading code I didn't write.

The check that never checked a file: reading code I didn't write

I generated a Linux persistence triage tool with an LLM, used it in a research project, and only read it properly much later. Its headline check had never examined a single file. What I found, why the tool still produced convincing output, and how to read code you didn’t write.

July 29, 2026 · 12 min · Kartik Sankhla
The file we couldn't recover — an ext3 deleted-file investigation

The file we couldn't recover: an ext3 deleted-file investigation

A user created five files and deleted some. Recovering them from an ext3 image meant Trash artifacts, orphan inodes full of GNOME metadata — and proving why one file was gone for good.

May 30, 2026 · 6 min · Kartik Sankhla