Data Recovery

[Thomas Foster]

I hope that you have remounted this filesystem read-only .. or else you 
might not be able to recover anything.  That might be one of the problems 
you are running into.

Sleuthkit allows you to search inodes and fragment ranges of a device for 
particular file and directory names.. then images that inode or fragment 
range into a single image file elsewhere on the system.

Foremost will then open that image file and extract files based on their 
header and footer information, but.. if you do not include footer 
information you might get truncated file recovery.  Also.. as  stated 
before.. if there have been multiple writes to the file system.. you 
probably wont get the file back at all.

Hope this helps..

T
----- Original Message ----- 
From: "Yanek Korff" <yanek at mail.com>
To: <freebsd-questions at freebsd.org>
Sent: Thursday, March 17, 2005 10:24 AM
Subject: Data Recovery


>
> Are there any ways to recover files from rm -rf dirname after a few days, 
> assuming there have been few if any writes to the filesystem since?
>
> I've been playing with tools like foremost and jpegrescue a bit... and 
> running tests on other filesystems, but it doesn't appear that I'm getting 
> full images back from the disk.  Looking at an octal dump of a disk image 
> (dd if=/dev/blah of=/some/file), I can find the file header... and about 
> 20k of the file, generally... and then there's garbage.  Presumably the 
> file's been broken into blocks and there's inode table data to consider...
>
> The tests I"m running are trying to find jpeg files that HAVEN'T been 
> deleted from the filesystem.  My real scenario of course differs.
>
> Pointers/rtfm welcome.
>
> -Yanek.
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to 
> "freebsd-questions-unsubscribe at freebsd.org"
>