From owner-freebsd-questions@FreeBSD.ORG Mon Jun 11 20:41:24 2007 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 506E916A41F for ; Mon, 11 Jun 2007 20:41:24 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from mail-out3.apple.com (mail-out3.apple.com [17.254.13.22]) by mx1.freebsd.org (Postfix) with ESMTP id 3768D13C469 for ; Mon, 11 Jun 2007 20:41:24 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from relay8.apple.com (relay8.apple.com [17.128.113.38]) by mail-out3.apple.com (Postfix) with ESMTP id 8FB6A88A888; Mon, 11 Jun 2007 13:40:19 -0700 (PDT) Received: from relay8.apple.com (unknown [127.0.0.1]) by relay8.apple.com (Symantec Mail Security) with ESMTP id 1734D400EB; Mon, 11 Jun 2007 13:41:24 -0700 (PDT) X-AuditID: 11807126-a1888bb00000081c-b5-466db374ec7b Received: from [17.214.13.96] (cswiger1.apple.com [17.214.13.96]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by relay8.apple.com (Apple SCV relay) with ESMTP id 00C3840055; Mon, 11 Jun 2007 13:41:24 -0700 (PDT) In-Reply-To: <466DAF67.6080804@broadpark.no> References: <466DAF67.6080804@broadpark.no> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=ISO-8859-1; delsp=yes; format=flowed Message-Id: <6D458F25-9A4A-4DA3-BB11-F25E67831F84@mac.com> Content-Transfer-Encoding: quoted-printable From: Chuck Swiger Date: Mon, 11 Jun 2007 13:41:23 -0700 To: =?ISO-8859-1?Q?Kyrre_Nyg=E5rd?= X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAA== Cc: questions@freebsd.org Subject: Re: Is there a way to undelete? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jun 2007 20:41:24 -0000 On Jun 11, 2007, at 1:24 PM, Kyrre Nyg=E5rd wrote: > I'm just curious if there's a way to undo a rm -rf. Yes. Restore the deleted files from the backups you previously took. > There has to be something eq[u]ivalent in FreeBSD to all those =20 > recovery tools? Oh, there is. There's the Coroner's toolkit here: http://www.porcupine.org/forensics/tct.html ...with unrm & lazarus utilities which are capable, in theory, of =20 undeleting rm'ed files. This being said, because Unix systems involve many daemon processes =20 like syslog and cron and so forth which continue to write data to the =20= disks, it turns out to be relatively likely that files which are =20 deleted will get over-written more quickly than they would be in a =20 single-tasking or limited multi-tasking environment like DOS or early =20= flavors of Windows. --=20 -Chuck