From owner-freebsd-fs@FreeBSD.ORG Fri Jan 9 00:55:58 2009 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 57469106564A for ; Fri, 9 Jan 2009 00:55:58 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from mail-out4.apple.com (mail-out4.apple.com [17.254.13.23]) by mx1.freebsd.org (Postfix) with ESMTP id 3CBE58FC1C for ; Fri, 9 Jan 2009 00:55:58 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from relay13.apple.com (relay13.apple.com [17.128.113.29]) by mail-out4.apple.com (Postfix) with ESMTP id CAF184DD6318; Thu, 8 Jan 2009 16:36:00 -0800 (PST) Received: from relay13.apple.com (unknown [127.0.0.1]) by relay13.apple.com (Symantec Brightmail Gateway) with ESMTP id B52222808C; Thu, 8 Jan 2009 16:36:00 -0800 (PST) X-AuditID: 1180711d-ad82fbb000000ff0-bf-49669bf0f4bf Received: from cswiger1.apple.com (cswiger1.apple.com [17.227.140.124]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by relay13.apple.com (Apple SCV relay) with ESMTP id 9901B28088; Thu, 8 Jan 2009 16:36:00 -0800 (PST) Message-Id: From: Chuck Swiger To: Polytropon In-Reply-To: <20090109002846.c67d962f.freebsd@edvax.de> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v930.3) Date: Thu, 8 Jan 2009 16:36:00 -0800 References: <20090109002846.c67d962f.freebsd@edvax.de> X-Mailer: Apple Mail (2.930.3) X-Brightmail-Tracker: AAAAAA== Cc: FreeBSD FS , FreeBSD Questions Subject: Re: Restore deleted files X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jan 2009 00:55:59 -0000 On Jan 8, 2009, at 3:28 PM, Polytropon wrote: > I'd like to ask a two-stage question: > > 1. Is it possible to recover files that have been deleted? > > 2. Which tools or procedures are suggested for recovery? The preferred method is to recover files from backup. If you don't take backups, you've decided that you don't really care about the data. This being said, you might take a look at something like: > % cat /usr/ports/sysutils/sleuthkit/pkg-descr > The Sleuth Kit (previously known as TASK) is a collection of UNIX- > based > command line file system and media management forensic analysis > tools. The > file system tools allow you to examine file systems of a suspect > computer in > a non-intrusive fashion. > > The media management tools allow you to examine the layout of disks > and > other media. The Sleuth Kit supports DOS partitions, BSD partitions > (disk > labels), Mac partitions, Sun slices (Volume Table of Contents), and > GPT > disks. With these tools, you can identify where partitions are > located and > extract them so that they can be analyzed with file system analysis > tools. > > WWW: http://www.sleuthkit.org/sleuthkit/ This can be used to attempt to "undelete" files from a UFS filesystem.... Regards, -- -Chuck