From owner-freebsd-questions@FreeBSD.ORG Wed Aug 16 19:25:22 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 126AF16A4DF for ; Wed, 16 Aug 2006 19:25:22 +0000 (UTC) (envelope-from dave.list@pixelhammer.com) Received: from ecluster6.tls.net (ecluster6.tls.net [65.196.224.136]) by mx1.FreeBSD.org (Postfix) with SMTP id 7D00643D4C for ; Wed, 16 Aug 2006 19:25:21 +0000 (GMT) (envelope-from dave.list@pixelhammer.com) Received: (qmail 33421 invoked by uid 89); 16 Aug 2006 19:25:20 -0000 Received: from 204-8-12-19.bb.hrtc.net (HELO ?192.168.0.103?) (ldg%tls.net@204.8.12.19) by auth-ecluster6.tls.net with SMTP; 16 Aug 2006 19:25:20 -0000 Message-ID: <44E37106.7040807@pixelhammer.com> Date: Wed, 16 Aug 2006 15:24:54 -0400 From: DAve User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: <20060816162149.10420.qmail@web38708.mail.mud.yahoo.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: file restoration X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Aug 2006 19:25:22 -0000 Martin Tournoij wrote: > On Wed, 16 Aug 2006 18:21:49 +0200, Mark Manzano wrote: > >> Hi, >> I am using freeBSD Unix and someone deleted a bunch of files from the >> hard drive. I know when you delete a file from unix, only the pointer >> or inode is deleted and not the actual file. From a software >> perspective, the information is probally gone. However on a hardware >> perspective I believe the data is still there. Are there any tools to >> retrieve the lost files? >> This is what I want to do: >> On the hardware level the hard drive is a physical storage device >> with little tiny "switches" that flip between 1's and 0's. Those >> switches stay set to whatever they were set at unless they are set to >> something else. What I want to attach the hard drive to another >> computer with a second hard drive in it (a blank one) and boot to a >> floppy disk. From there, a program or tool will scan all the switches >> ( 1s and 0s) to try to find patterns that indicate the presence of >> files. Then copy those files to the blank hard drive. >> Thank you. >> >> > > There are several commercial tools that can restore file on a UFS > partition, I'm not aware of any free tools > > I used Stellar Phoenix (sucsesfully) a while ago after a windows crash > destoyed my part of my UFS partition (grmbl!) > http://www.stellarinfo.com/disk-recovery.htm#bsd > > Not cheap though, $355, I don't want to encourage illegal software use, I have used The Coroners Toolkit to recover files on Solaris a few years ago, nearly an entire partition. The learning curve is a bit steep but there are several how-tos available. It is more intended as an 'after breakin' discovery tool, but it recovers files quite well. http://www.porcupine.org/forensics/ DAve -- Three years now I've asked Google why they don't have a logo change for Memorial Day. Why do they choose to do logos for other non-international holidays, but nothing for Veterans? Maybe they forgot who made that choice possible.