Re: Is there a way to undelete?
On Jun 11, 2007, at 1:24 PM, Kyrre Nygård wrote: I'm just curious if there's a way to undo a rm -rf. Yes. Restore the deleted files from the backups you previously took. There has to be something eq[u]ivalent in FreeBSD to all those recovery tools? Oh, there is. There's the Coroner's toolkit here: http://www.porcupine.org/forensics/tct.html ...with unrm lazarus utilities which are capable, in theory, of undeleting rm'ed files. This being said, because Unix systems involve many daemon processes like syslog and cron and so forth which continue to write data to the disks, it turns out to be relatively likely that files which are deleted will get over-written more quickly than they would be in a single-tasking or limited multi-tasking environment like DOS or early flavors of Windows. -- -Chuck ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: Is there a way to undelete?
On Mon, Jun 11, 2007 at 10:24:07PM +0200, Kyrre Nygård wrote: Hello! I'm just curious if there's a way to undo a rm -rf. There has to be something eqivalent in FreeBSD to all those recovery tools? Unless you've written new data to the disk, the old data is still there. So yes it is possible to recover files. Google for UFS recovery. But unless you've made a backup (which you should) it won't be easy. There is restore(8), in case you've made backups with dump(8). You could also set up a cron job to make nightly snapshots, and mount them somewhere so you can access the filesystem as it existed at the time the snapshot was taken. This way you don't have to mess around with backup media. Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725) pgpfBhivnZk8j.pgp Description: PGP signature
Re: Is there a way to undelete?
On 6/11/07, Kyrre Nygård [EMAIL PROTECTED] wrote: Hello! Hi ! I'm just curious if there's a way to undo a rm -rf. There has to be something eqivalent in FreeBSD to all those recovery tools? Maybe... after that, mount your filesystem read-only, do a full block copy (something like dd if=/dev/of/deleted_files of=/some/path/deleted.dd), pray... and Install /usr/ports/sysutils/sleuthkit and /usr/ports/sysutils/autopsy Look at www.sleuthkit.org, this site has useful articles on how to use these tools. Regards, Alexandre ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
