Thanks Robert,
The strings method worked very well in this instance.
-Original Message-
From: Robert Watson [mailto:[EMAIL PROTECTED]
Sent: Thursday, 13 November 2003 1:59 PM
To: Barney Wolff
Cc: Thyer, Matthew; '[EMAIL PROTECTED]'
Subject: Re: undelete for FreeBSD current?
On Wed, 12
I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/ after
a rm -rf of /usr/local
I've kept the file system relatively quiet since then.
Is there a port that can achieve this?
Otherwise pointers to web sites or mail archives regarding the use of fsdb to achieve
this
On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote:
I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/
after a rm -rf of /usr/local
I've kept the file system relatively quiet since then.
TCT may help. http://www.porcupine.org/forensics/tct.html but
On Wed, 12 Nov 2003, Barney Wolff wrote:
On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote:
I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/
after a rm -rf of /usr/local
I've kept the file system relatively quiet since then.
TCT may help.
