From owner-freebsd-current@FreeBSD.ORG  Wed Nov 12 19:31:20 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1C46216A4CE
	for <current@freebsd.org>; Wed, 12 Nov 2003 19:31:20 -0800 (PST)
Received: from fledge.watson.org (fledge.watson.org [204.156.12.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0B72E43F3F
	for <current@freebsd.org>; Wed, 12 Nov 2003 19:31:19 -0800 (PST)
	(envelope-from robert@fledge.watson.org)
Received: from fledge.watson.org (localhost [127.0.0.1])
	by fledge.watson.org (8.12.9p2/8.12.9) with ESMTP id hAD3TNMg097721;
	Wed, 12 Nov 2003 22:29:23 -0500 (EST)
	(envelope-from robert@fledge.watson.org)
Received: from localhost (robert@localhost)hAD3TNCP097718;
	Wed, 12 Nov 2003 22:29:23 -0500 (EST)
	(envelope-from robert@fledge.watson.org)
Date: Wed, 12 Nov 2003 22:29:23 -0500 (EST)
From: Robert Watson <rwatson@freebsd.org>
X-Sender: robert@fledge.watson.org
To: Barney Wolff <barney@databus.com>
In-Reply-To: <20031113012648.GA46137@pit.databus.com>
Message-ID: <Pine.NEB.3.96L.1031112222809.96006D-100000@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: "Thyer, Matthew" <Matthew.Thyer@dsto.defence.gov.au>
cc: "'current@freebsd.org'" <current@freebsd.org>
Subject: Re: undelete for FreeBSD current?
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 Nov 2003 03:31:20 -0000


On Wed, 12 Nov 2003, Barney Wolff wrote:

> On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote:
> > I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/ after a rm -rf of /usr/local
> > 
> > I've kept the file system relatively quiet since then.
> 
> TCT may help.  http://www.porcupine.org/forensics/tct.html but I don't
> think it's been tested with current/ufs2.  Also, don't expect to build
> it on the system and then find a deleted file. 
> 
> But if you have a clue of what you're looking for, just grepping
> /dev/da<n> or /dev/ad<n> might work.  (grep -a -A100 -B100) 

Assuming that the file system had a fair amount of free space, and
therefore wasn't fragmented, I've always found the "strings" command quite
helpful in recovering text files after loss or deletion.  It can also be
nicely applied to /dev/mem if you accidentally close that pesky editor
window without save... 

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert@fledge.watson.org      Network Associates Laboratories