Date: Mon, 20 Jan 2003 10:54:10 -0500 From: Bill Moran <wmoran@potentialtech.com> To: bastill@adam.com.au Cc: freebsd-questions@freebsd.org Subject: Re: Deleted files - recovery Message-ID: <3E2C1BA2.6090409@potentialtech.com> References: <1042951588.3e2a2da491b10@webmail.adam.com.au> <3E2AFAB8.7000508@potentialtech.com> <1043040535.3e2b89179860d@webmail.adam.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
bastill@adam.com.au wrote: > Though you might like to see the results of some relevant web-surfing. > > For data recovery on Windows and Ext2 file systems: > R-Tools http://www.r-tt.com/ > > Tool to check and undelete partitions (not data) on: > - FAT12 FAT16 FAT32 > - Linux > - Linux SWAP (version 1 and 2) > - NTFS (Windows NT) > - BeFS (BeOS) > - UFS (BSD) > - Netware > - RaiserFS > http://www.cgsecurity.org//testdisk.html > > The general opinions on unerasing are that its basically not possible on a ufs > system, use AdvFS if this ability is required. While this is the "general opinion", my research has determined that undeleting files is just very difficult, and therefore "impossible" to the average hacker, although it really is possible. The _main_ issue, is that (because of the way UFS allocates disk space) if you've done _any_ writing to the disk since you rm'ed the files, you've probably overwritten some of them. > However there is a utility at: > ftp://gatekeeper.dec.com/pub/sysadm/recover.tar.Z > [I found this did not resolve for me, but the URL below, did] > http://www.ccl.net/cca/software/UNIX/recover-files-after-rm/index.shtml Hmmm ... this still isn't the article I remember. It's very frustrating, I should have bookmarked it. The article I remembered actually talked you through reassembling the files, and it was written well enough that most people would be able to follow along. The part that amazed me was how tedious and time-consuming the process was. Well, one way or the other, I hope you manage to recover some of what you lost. -- Bill Moran Potential Technologies http://www.potentialtech.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3E2C1BA2.6090409>