Date: Fri, 9 Jan 2009 01:49:14 +0100 From: Roland Smith <rsmith@xs4all.nl> To: Polytropon <freebsd@edvax.de> Cc: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: Restore deleted files Message-ID: <20090109004914.GC2177@slackbox.xs4all.nl> In-Reply-To: <20090109002846.c67d962f.freebsd@edvax.de> References: <20090109002846.c67d962f.freebsd@edvax.de>
next in thread | previous in thread | raw e-mail | index | archive | help
--vOmOzSkFvhd7u8Ms Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jan 09, 2009 at 12:28:46AM +0100, Polytropon wrote: > Hi, >=20 > I'd like to ask a two-stage question: >=20 > 1. Is it possible to recover files that have been deleted? Sure. You just restore them from backups. (Sorry, couldn't resist. :-) If you don't have backups it might be possible, if the data has not been overwritten. > 2. Which tools or procedures are suggested for recovery? Try sysutils/sleuthkit [http://www.sleuthkit.org/]. <snip> > Just after I noticed what I had done I unmounted the file system, > powered off the machine and put the disk on the shelf (it's still > there), no further write accesses. You did the right thing here. Your information is probably still there. It should probably be possible to restore the files, but it could take a lot of effort. Use dd to make an image of the harddisk, and work on = that. Roland --=20 R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725) --vOmOzSkFvhd7u8Ms Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (FreeBSD) iEYEARECAAYFAklmnwoACgkQEnfvsMMhpyUO2wCgmSdAmnICkei7HmSMwp2zyXrL pWYAn14AdPEHgupfxet35qMz34a+iU3u =U4F0 -----END PGP SIGNATURE----- --vOmOzSkFvhd7u8Ms--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090109004914.GC2177>