From owner-freebsd-hackers Tue Oct 10 20:34: 5 2000 Delivered-To: freebsd-hackers@freebsd.org Received: from mail.kyx.net (cr95838-b.crdva1.bc.wave.home.com [24.113.50.147]) by hub.freebsd.org (Postfix) with ESMTP id D6B9F37B503 for ; Tue, 10 Oct 2000 20:34:03 -0700 (PDT) Received: from smp.kyx.net (unknown [10.22.22.45]) by mail.kyx.net (Postfix) with SMTP id E31A01DC05; Tue, 10 Oct 2000 20:34:39 -0700 (PDT) From: Dragos Ruiu Organization: kyx.net To: Adam Klinkel , hackers@freebsd.org Subject: Re: Possible undelete Date: Tue, 10 Oct 2000 20:33:08 -0700 X-Mailer: KYX-CP/M [version core00-mail-92] Content-Type: text/plain References: <4.3.2.7.0.20001010115054.00aa2bf0@mailhost.kal.ameritech.net> <0010102030520Q.40602@smp.kyx.net> In-Reply-To: <0010102030520Q.40602@smp.kyx.net> MIME-Version: 1.0 Message-Id: <0010102034500R.40602@smp.kyx.net> Content-Transfer-Encoding: 8bit Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Tue, 10 Oct 2000, Dragos Ruiu wrote: > Is there anyway I can retrieve the files? Unfortunately > > I cannot unmount the device because it hosts critical applications. > Check out the unrm/lazarus tools in Dan Farmer's and Wietse Venema's The > Coroner's Toolkit (TCT) http://www.porcupine.org/forensics/tct.html > > --dr Oh and you'll have better mileage if you try to keep the disk as quiet as possible before. Compile TCT on another machine or the make could start walking over the files you're trying to save. cheers, --dr -- Dragos Ruiu dursec.com ltd. / kyx.net - we're from the future gpg/pgp key on file at wwwkeys.pgp.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message