undelete for FreeBSD current?

Barney Wolff barney at databus.com
Wed Nov 12 17:26:53 PST 2003

On Thu, Nov 13, 2003 at 11:30:51AM +1030, Thyer, Matthew wrote:
> I've done a bad thing and need to recover a single file in /usr/local/etc/rc.d/ after a rm -rf of /usr/local
> I've kept the file system relatively quiet since then.

TCT may help.  http://www.porcupine.org/forensics/tct.html but I don't
think it's been tested with current/ufs2.  Also, don't expect to build
it on the system and then find a deleted file.

But if you have a clue of what you're looking for, just grepping /dev/da<n>
or /dev/ad<n> might work.  (grep -a -A100 -B100)

Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.

More information about the freebsd-current mailing list