Date: Wed, 16 Aug 2006 15:24:54 -0400 From: DAve <dave.list@pixelhammer.com> To: freebsd-questions@freebsd.org Subject: Re: file restoration Message-ID: <44E37106.7040807@pixelhammer.com> In-Reply-To: <op.ted356ijoycwod@carpet> References: <20060816162149.10420.qmail@web38708.mail.mud.yahoo.com> <op.ted356ijoycwod@carpet>
next in thread | previous in thread | raw e-mail | index | archive | help
Martin Tournoij wrote: > On Wed, 16 Aug 2006 18:21:49 +0200, Mark Manzano <mwcmark@yahoo.com> wrote: > >> Hi, >> I am using freeBSD Unix and someone deleted a bunch of files from the >> hard drive. I know when you delete a file from unix, only the pointer >> or inode is deleted and not the actual file. From a software >> perspective, the information is probally gone. However on a hardware >> perspective I believe the data is still there. Are there any tools to >> retrieve the lost files? >> This is what I want to do: >> On the hardware level the hard drive is a physical storage device >> with little tiny "switches" that flip between 1's and 0's. Those >> switches stay set to whatever they were set at unless they are set to >> something else. What I want to attach the hard drive to another >> computer with a second hard drive in it (a blank one) and boot to a >> floppy disk. From there, a program or tool will scan all the switches >> ( 1s and 0s) to try to find patterns that indicate the presence of >> files. Then copy those files to the blank hard drive. >> Thank you. >> >> > > There are several commercial tools that can restore file on a UFS > partition, I'm not aware of any free tools > > I used Stellar Phoenix (sucsesfully) a while ago after a windows crash > destoyed my part of my UFS partition (grmbl!) > http://www.stellarinfo.com/disk-recovery.htm#bsd > > Not cheap though, $355, I don't want to encourage illegal software use, I have used The Coroners Toolkit to recover files on Solaris a few years ago, nearly an entire partition. The learning curve is a bit steep but there are several how-tos available. It is more intended as an 'after breakin' discovery tool, but it recovers files quite well. http://www.porcupine.org/forensics/ DAve -- Three years now I've asked Google why they don't have a logo change for Memorial Day. Why do they choose to do logos for other non-international holidays, but nothing for Veterans? Maybe they forgot who made that choice possible.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44E37106.7040807>