Re: recover deleted file

From: Alexandre Biancalana <biancalana_at_gmail.com>
Date: Sat, 16 Apr 2022 12:44:43 UTC
On Sat, 16 Apr 2022 at 09:33 Sami Halabi <sodynet1@gmail.com> wrote:

> how to do step 3 /?
>
> On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <grembo@freebsd.org> wrote:
>
>> Depends on the kind of file.
>>
>> You can always:
>> 1. reboot the system into single user mode, mount the fs readonly
>> (important to not overwrite data you want to recover)
>> 2. dd the partition and into a file
>> 3. find the content of the deleted file in the dump
>>
>> I was able to recover a complete codebase i deleted accidentally that way
>> a long time ago.
>>
>> Good luck
>> Michael
>>
>> On 16. Apr 2022, at 13:52, Sami Halabi <sodynet1@gmail.com> wrote:
>>
>> 
>> well.. thats the trivial answer.. the problem is backups is a day
>> before... if i can undelete it would save me loss of 1 day offset..
>>
>> anyone?
>>
>> On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <guru@unixarea.de> wrote:
>>
>>> El día sábado, abril 16, 2022 a las 02:23:25 +0300, Sami Halabi escribió:
>>>
>>> > Hi,
>>> > is there anyway easy to restore deleted file by accident in UFS????
>>>
>>> Yes, restore it from a backup media.
>>>
>>>         matthias
>>>
>>>
>>> --
>>> Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/
>>> +49-176-38902045
>>> Public GnuPG key: http://www.unixarea.de/key.pub
>>>
>>> Peace instead of NATO!  Мир вместо НАТО!  Frieden statt NATO! ¡Paz en
>>> vez de OTAN!
>>>
>>>
>>
>> --
>> Sami Halabi
>> Information Systems Engineer
>> NMS Projects Expert, FreeBSD SysAdmin Expert
>> Asterisk Expert
>>
>>
>
> --
> Sami Halabi
> Information Systems Engineer
> NMS Projects Expert, FreeBSD SysAdmin Expert
> Asterisk Expert
>

Look at autopsy/photorec

https://www.cgsecurity.org/wiki/PhotoRec_Data_Carving