Data Recovery

Yanek Korff yanek at mail.com
Thu Mar 17 10:24:11 PST 2005


Are there any ways to recover files from rm -rf dirname after a few 
days, assuming there have been few if any writes to the filesystem since?

I've been playing with tools like foremost and jpegrescue a bit... and 
running tests on other filesystems, but it doesn't appear that I'm 
getting full images back from the disk.  Looking at an octal dump of a 
disk image (dd if=/dev/blah of=/some/file), I can find the file 
header... and about 20k of the file, generally... and then there's 
garbage.  Presumably the file's been broken into blocks and there's 
inode table data to consider...

The tests I"m running are trying to find jpeg files that HAVEN'T been 
deleted from the filesystem.  My real scenario of course differs.

Pointers/rtfm welcome.

-Yanek.


More information about the freebsd-questions mailing list