Date: Wed, 12 Nov 2003 22:29:23 -0500 (EST) From: Robert Watson <rwatson@freebsd.org> To: Barney Wolff <barney@databus.com> Cc: "'current@freebsd.org'" <current@freebsd.org> Subject: Re: undelete for FreeBSD current? Message-ID: <Pine.NEB.3.96L.1031112222809.96006D-100000@fledge.watson.org> In-Reply-To: <20031113012648.GA46137@pit.databus.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 12 Nov 2003, Barney Wolff wrote: > On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote: > > I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/ after a rm -rf of /usr/local > > > > I've kept the file system relatively quiet since then. > > TCT may help. http://www.porcupine.org/forensics/tct.html but I don't > think it's been tested with current/ufs2. Also, don't expect to build > it on the system and then find a deleted file. > > But if you have a clue of what you're looking for, just grepping > /dev/da<n> or /dev/ad<n> might work. (grep -a -A100 -B100) Assuming that the file system had a fair amount of free space, and therefore wasn't fragmented, I've always found the "strings" command quite helpful in recovering text files after loss or deletion. It can also be nicely applied to /dev/mem if you accidentally close that pesky editor window without save... Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Network Associates Laboratories
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.3.96L.1031112222809.96006D-100000>