From owner-freebsd-questions Mon Jan 20 7:55: 0 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 77BF837B401 for ; Mon, 20 Jan 2003 07:54:58 -0800 (PST) Received: from mail.adelphia.net (pa-plum1b-166.pit.adelphia.net [24.53.161.166]) by mx1.FreeBSD.org (Postfix) with ESMTP id 885F343F13 for ; Mon, 20 Jan 2003 07:54:52 -0800 (PST) (envelope-from wmoran@potentialtech.com) Received: from potentialtech.com ([172.16.0.95]) by mail.adelphia.net (8.12.3/8.12.3) with ESMTP id h0KFu8F2000355; Mon, 20 Jan 2003 10:56:09 -0500 (EST) (envelope-from wmoran@potentialtech.com) Message-ID: <3E2C1BA2.6090409@potentialtech.com> Date: Mon, 20 Jan 2003 10:54:10 -0500 From: Bill Moran User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.1) Gecko/20021127 X-Accept-Language: en-us, en MIME-Version: 1.0 To: bastill@adam.com.au Cc: freebsd-questions@freebsd.org Subject: Re: Deleted files - recovery References: <1042951588.3e2a2da491b10@webmail.adam.com.au> <3E2AFAB8.7000508@potentialtech.com> <1043040535.3e2b89179860d@webmail.adam.com.au> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG bastill@adam.com.au wrote: > Though you might like to see the results of some relevant web-surfing. > > For data recovery on Windows and Ext2 file systems: > R-Tools http://www.r-tt.com/ > > Tool to check and undelete partitions (not data) on: > - FAT12 FAT16 FAT32 > - Linux > - Linux SWAP (version 1 and 2) > - NTFS (Windows NT) > - BeFS (BeOS) > - UFS (BSD) > - Netware > - RaiserFS > http://www.cgsecurity.org//testdisk.html > > The general opinions on unerasing are that its basically not possible on a ufs > system, use AdvFS if this ability is required. While this is the "general opinion", my research has determined that undeleting files is just very difficult, and therefore "impossible" to the average hacker, although it really is possible. The _main_ issue, is that (because of the way UFS allocates disk space) if you've done _any_ writing to the disk since you rm'ed the files, you've probably overwritten some of them. > However there is a utility at: > ftp://gatekeeper.dec.com/pub/sysadm/recover.tar.Z > [I found this did not resolve for me, but the URL below, did] > http://www.ccl.net/cca/software/UNIX/recover-files-after-rm/index.shtml Hmmm ... this still isn't the article I remember. It's very frustrating, I should have bookmarked it. The article I remembered actually talked you through reassembling the files, and it was written well enough that most people would be able to follow along. The part that amazed me was how tedious and time-consuming the process was. Well, one way or the other, I hope you manage to recover some of what you lost. -- Bill Moran Potential Technologies http://www.potentialtech.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message