file restoration

[DAve]

Martin Tournoij wrote:
> On Wed, 16 Aug 2006 18:21:49 +0200, Mark Manzano <mwcmark at yahoo.com> wrote:
> 
>> Hi,
>>  I am using freeBSD Unix and someone deleted a bunch of files from the 
>> hard drive. I know when you delete a file from unix, only the pointer 
>> or inode is deleted and not the actual file. From a software 
>> perspective,  the information is probally gone. However on a hardware 
>> perspective I believe the data is still there.  Are there any tools to 
>> retrieve the lost files?
>>  This is what I want to do:
>>    On the hardware level the hard drive is a physical storage device 
>> with little tiny "switches" that flip between 1's and 0's. Those 
>> switches stay set to whatever they were set at unless they are set to 
>> something else. What I want to attach the hard drive to another 
>> computer with a second hard drive in it (a blank one) and boot to a 
>> floppy disk. From there, a program or tool will scan all the switches 
>> ( 1s and 0s) to try to find patterns that indicate the presence of 
>> files. Then copy those files to the blank hard drive.
>>  Thank you.
>>
>>         
> 
> There are several commercial tools that can restore file on a UFS 
> partition, I'm not aware of any free tools
> 
> I used Stellar Phoenix (sucsesfully) a while ago after a windows crash 
> destoyed my part of my UFS partition (grmbl!)
> http://www.stellarinfo.com/disk-recovery.htm#bsd
> 
> Not cheap though, $355, I don't want to encourage illegal software use, 

I have used The Coroners Toolkit to recover files on Solaris a few years 
ago, nearly an entire partition. The learning curve is a bit steep but 
there are several how-tos available. It is more intended as an 'after 
breakin' discovery tool, but it recovers files quite well.

http://www.porcupine.org/forensics/

DAve



-- 
Three years now I've asked Google why they don't have a
logo change for Memorial Day. Why do they choose to do logos
for other non-international holidays, but nothing for
Veterans?

Maybe they forgot who made that choice possible.