Re: undelete for FreeBSD current?

From: Barney Wolff <barney_at_databus.com>
Date: Wed, 12 Nov 2003 20:26:48 -0500
On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote:
> I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/ after a rm -rf of /usr/local
> 
> I've kept the file system relatively quiet since then.

TCT may help.  http://www.porcupine.org/forensics/tct.html but I don't
think it's been tested with current/ufs2.  Also, don't expect to build
it on the system and then find a deleted file.

But if you have a clue of what you're looking for, just grepping /dev/da<n>
or /dev/ad<n> might work.  (grep -a -A100 -B100)

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
Received on Wed Nov 12 2003 - 16:26:53 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:28 UTC