From owner-freebsd-questions Sat Dec 2 13:58:59 2000 Delivered-To: freebsd-questions@freebsd.org Received: from guru.mired.org (okc-65-26-235-186.mmcable.com [65.26.235.186]) by hub.freebsd.org (Postfix) with SMTP id E750A37B401 for ; Sat, 2 Dec 2000 13:58:55 -0800 (PST) Received: (qmail 5176 invoked by uid 100); 2 Dec 2000 21:58:49 -0000 From: Mike Meyer MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <14889.28825.573909.407534@guru.mired.org> Date: Sat, 2 Dec 2000 15:58:49 -0600 (CST) To: verter@mail.ru Cc: questions@freebsd.org Subject: Re: Need to talk In-Reply-To: <28144343@toto.iv> X-Mailer: VM 6.75 under 21.1 (patch 10) "Capitol Reef" XEmacs Lucid X-face: "5Mnwy%?j>IIV\)A=):rjWL~NB2aH[}Yq8Z=u~vJ`"(,&SiLvbbz2W`;h9L,Yg`+vb1>RG% *h+%X^n0EZd>TM8_IB;a8F?(Fb"lw'IgCoyM.[Lg#r\ X-Message: You should get a better mailer. Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG verter@mail.ru types: > Hi, > > Would you please advise who can answer questions on the UFS > structure? Or provide link/site, if any, providing that? > > I'm writing in the name of the Russian hosting company "Majordomo.Ru". > Our server was hacked a week ago - and all information was destroyed > (we presume rm -rf command was used). > Using software like diskedit we can dig for some > information (backup, as you might realize, is just a dream and plans to > be implemented next week). So, we searched for the info on detailed > UFS structure - and didn't find anything but general descriptions and > rather vague tables. So, we are trying to restore some importane files > and, if possible, out database. As we think exact info on the UFS > would be of primary importance in this case. The reason things are vague is because they are changing. If you want detailed information about what you were running, look in the source tree. The include files are particularly usefull. This is a *very* delicate thing to want to do. If what's on the disks is really valuable, and you didn't have backups, you might consider contacting some of the people on the consultants list to see if any of them have done this kind of thing before, then pay them to do it for you. http://www.mired.org/home/mwm/ Independent WWW/Unix/FreeBSD consultant, email for more information. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message