In the context of the lecture IT-Forensics (which I really enjoyed!) at the University of Applied Sciences in Augsburg, I recently did a forensic analysis of the Ext3 Linux filesystem.

Read the full paper (in german) here.