Date: Mon, 11 Jun 2007 13:41:23 -0700 From: Chuck Swiger <cswiger@mac.com> To: =?ISO-8859-1?Q?Kyrre_Nyg=E5rd?= <kyrreny@broadpark.no> Cc: questions@freebsd.org Subject: Re: Is there a way to undelete? Message-ID: <6D458F25-9A4A-4DA3-BB11-F25E67831F84@mac.com> In-Reply-To: <466DAF67.6080804@broadpark.no> References: <466DAF67.6080804@broadpark.no>
next in thread | previous in thread | raw e-mail | index | archive | help
On Jun 11, 2007, at 1:24 PM, Kyrre Nyg=E5rd wrote: > I'm just curious if there's a way to undo a rm -rf. Yes. Restore the deleted files from the backups you previously took. > There has to be something eq[u]ivalent in FreeBSD to all those =20 > recovery tools? Oh, there is. There's the Coroner's toolkit here: http://www.porcupine.org/forensics/tct.html ...with unrm & lazarus utilities which are capable, in theory, of =20 undeleting rm'ed files. This being said, because Unix systems involve many daemon processes =20 like syslog and cron and so forth which continue to write data to the =20= disks, it turns out to be relatively likely that files which are =20 deleted will get over-written more quickly than they would be in a =20 single-tasking or limited multi-tasking environment like DOS or early =20= flavors of Windows. --=20 -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6D458F25-9A4A-4DA3-BB11-F25E67831F84>