Date: Mon, 11 Jun 2007 13:41:23 -0700 From: Chuck Swiger <cswiger@mac.com> To: =?ISO-8859-1?Q?Kyrre_Nyg=E5rd?= <kyrreny@broadpark.no> Cc: questions@freebsd.org Subject: Re: Is there a way to undelete? Message-ID: <6D458F25-9A4A-4DA3-BB11-F25E67831F84@mac.com> In-Reply-To: <466DAF67.6080804@broadpark.no> References: <466DAF67.6080804@broadpark.no>
next in thread | previous in thread | raw e-mail | index | archive | help
On Jun 11, 2007, at 1:24 PM, Kyrre Nygård wrote: > I'm just curious if there's a way to undo a rm -rf. Yes. Restore the deleted files from the backups you previously took. > There has to be something eq[u]ivalent in FreeBSD to all those > recovery tools? Oh, there is. There's the Coroner's toolkit here: http://www.porcupine.org/forensics/tct.html ...with unrm & lazarus utilities which are capable, in theory, of undeleting rm'ed files. This being said, because Unix systems involve many daemon processes like syslog and cron and so forth which continue to write data to the disks, it turns out to be relatively likely that files which are deleted will get over-written more quickly than they would be in a single-tasking or limited multi-tasking environment like DOS or early flavors of Windows. -- -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6D458F25-9A4A-4DA3-BB11-F25E67831F84>