Is there a way to undelete?

[Chuck Swiger]

On Jun 11, 2007, at 1:24 PM, Kyrre Nygård wrote:
> I'm just curious if there's a way to undo a rm -rf.

Yes.  Restore the deleted files from the backups you previously took.

> There has to be something eq[u]ivalent in FreeBSD to all those  
> recovery tools?

Oh, there is.  There's the Coroner's toolkit here:

   http://www.porcupine.org/forensics/tct.html

...with unrm & lazarus utilities which are capable, in theory, of  
undeleting rm'ed files.

This being said, because Unix systems involve many daemon processes  
like syslog and cron and so forth which continue to write data to the  
disks, it turns out to be relatively likely that files which are  
deleted will get over-written more quickly than they would be in a  
single-tasking or limited multi-tasking environment like DOS or early  
flavors of Windows.

-- 
-Chuck