[Pauldotcom] foremost and data forensics

[Michael Miller]

If the system in question is using LVM on Linux I would suggest using
System Rescue CD. http://www.sysresccd.org/Main_Page

I use it all the time and it's updated on a regular basis.  Anyway how
to get at a LVM volume.

Boot from CD.
at the root prompt enter
#pvscan
That will show all of the physical volumes under LVM and the volume groups.
You can now run vgscan
#vgscan
vgscan finds the volume groups so you can now run lvscan
#lvscan
lvscan will report all the logical volumes on the disk.