Re: A way to recover deleted files (just contents) from USF2

From: Andrey Smirnov <smir_at_delit.net>
Date: Tue, 20 Apr 2004 17:16:12 +0400
Brad Knowles wrote:
> At 7:50 AM -0500 2004/04/20, Steve Ames wrote:
> 
>>  That's kinda silly. Unless files are backed up at every edit then 
>> most of
>>  us only have periodic filesystem backups. Lets say I just download a 
>> 150M
>>  file and then accidentally delete it. Rather than wasting time and 
>> bandwidth
>>  downloading again it'd be simpler to just 'unrm' it. Odds are that 
>> diskspace
>>  and even inode haven't been recycled yet.
> 
> 
>     Well, if you can't get ffsrecov to work, there's always Wietse 
> Venema's "The Coroner's Toolkit", which includes "unrm" and "lazarus" 
> tools.  See <http://www.porcupine.org/forensics/tct.html>.
> 
>     Of course, these kinds of things are never guaranteed to work, and 
> if you have to install them on top of the filesystem you're trying to 
> recover then odds are you're wiping out the very inodes you want to try 
> to save.
> 
I've got ffsrecov to work in several hours of fixing it up to work with 
UFS2. But actually it can do nothing with deleted files - their inodes 
are all zeroes, excluding uid/gid, which is less important to me....
Seems like everything is lost... ;-((((
Received on Tue Apr 20 2004 - 04:16:15 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:51 UTC