Date: Wed, 12 Nov 2003 20:26:48 -0500 From: Barney Wolff <barney@databus.com> To: "Thyer, Matthew" <Matthew.Thyer@dsto.defence.gov.au> Cc: "'current@freebsd.org'" <current@freebsd.org> Subject: Re: undelete for FreeBSD current? Message-ID: <20031113012648.GA46137@pit.databus.com> In-Reply-To: <5F13229E7BA2D611BD0300306E010DB08C9790@ednex503.dsto.defence.gov.au> References: <5F13229E7BA2D611BD0300306E010DB08C9790@ednex503.dsto.defence.gov.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote: > I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/ after a rm -rf of /usr/local > > I've kept the file system relatively quiet since then. TCT may help. http://www.porcupine.org/forensics/tct.html but I don't think it's been tested with current/ufs2. Also, don't expect to build it on the system and then find a deleted file. But if you have a clue of what you're looking for, just grepping /dev/da<n> or /dev/ad<n> might work. (grep -a -A100 -B100) -- Barney Wolff http://www.databus.com/bwresume.pdf I'm available by contract or FT, in the NYC metro area or via the 'Net.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031113012648.GA46137>