From owner-freebsd-questions@FreeBSD.ORG Tue Jun 12 02:55:28 2007 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 4C11816A46B for ; Tue, 12 Jun 2007 02:55:28 +0000 (UTC) (envelope-from biancalana@gmail.com) Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.226]) by mx1.freebsd.org (Postfix) with ESMTP id EAE6813C455 for ; Tue, 12 Jun 2007 02:55:27 +0000 (UTC) (envelope-from biancalana@gmail.com) Received: by wx-out-0506.google.com with SMTP id h28so1419989wxd for ; Mon, 11 Jun 2007 19:55:27 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=RXRD7Xi7UxQt2GzuemteSlML7N1ZFfGmKduhiS/cwZAC+WYThr68oxPsYlQSgbr/oixOT8tQS41ojJSogyscMKpFCItrKE0IAGxmyXEtHj3den0c3AFWR5t2XC5nIapWJ0w4uWrTyK52SwVIPIL8XfBtdVQ/lqK0z8LTb0RVH6w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=HmUeBlmH8/jUxC4eVbWv2tRQwtE9mp+k5atBqTQ8y2z6BZmA/4jUhwLkLG4zHC2wQG96B22eIkDchTf1CjoV9sg34Z26f6QnnUmjYiCoLBOW2aioO9dFYhObGzx28rPzV65bTGIfv6eiu/BBfxuM3UQT7gHCj13q1/imvNfADfM= Received: by 10.70.57.8 with SMTP id f8mr9498593wxa.1181615429673; Mon, 11 Jun 2007 19:30:29 -0700 (PDT) Received: by 10.70.63.4 with HTTP; Mon, 11 Jun 2007 19:30:29 -0700 (PDT) Message-ID: <8e10486b0706111930y7758be8nc733a84679f0dddf@mail.gmail.com> Date: Mon, 11 Jun 2007 23:30:29 -0300 From: "Alexandre Biancalana" To: "=?ISO-8859-1?Q?Kyrre_Nyg=E5rd?=" In-Reply-To: <466DAF67.6080804@broadpark.no> MIME-Version: 1.0 References: <466DAF67.6080804@broadpark.no> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Content-Disposition: inline X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: questions@freebsd.org Subject: Re: Is there a way to undelete? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2007 02:55:28 -0000 On 6/11/07, Kyrre Nyg=E5rd wrote: > > Hello! Hi ! I'm just curious if there's a way to undo a rm -rf. > There has to be something eqivalent in FreeBSD to all those recovery tools? Maybe... after that, mount your filesystem read-only, do a full block copy (something like dd if=3D/dev/of/deleted_files of=3D/some/path/deleted.dd), pray... and.... Install /usr/ports/sysutils/sleuthkit and /usr/ports/sysutils/autopsy Look at www.sleuthkit.org, this site has useful articles on how to use thes= e tools. Regards, Alexandre