Date: Tue, 10 Oct 2000 20:33:08 -0700 From: Dragos Ruiu <dr@kyx.net> To: Adam Klinkel <absolute1@ameritech.net>, hackers@freebsd.org Subject: Re: Possible undelete Message-ID: <0010102034500R.40602@smp.kyx.net> In-Reply-To: <0010102030520Q.40602@smp.kyx.net> References: <4.3.2.7.0.20001010115054.00aa2bf0@mailhost.kal.ameritech.net> <0010102030520Q.40602@smp.kyx.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 10 Oct 2000, Dragos Ruiu wrote: > Is there anyway I can retrieve the files? Unfortunately > > I cannot unmount the device because it hosts critical applications. > Check out the unrm/lazarus tools in Dan Farmer's and Wietse Venema's The > Coroner's Toolkit (TCT) http://www.porcupine.org/forensics/tct.html > > --dr Oh and you'll have better mileage if you try to keep the disk as quiet as possible before. Compile TCT on another machine or the make could start walking over the files you're trying to save. cheers, --dr -- Dragos Ruiu <dr@dursec.com> dursec.com ltd. / kyx.net - we're from the future gpg/pgp key on file at wwwkeys.pgp.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?0010102034500R.40602>