Restore deleted files

[Roland Smith]

On Fri, Jan 09, 2009 at 12:28:46AM +0100, Polytropon wrote:
> Hi,
> 
> I'd like to ask a two-stage question:
> 
> 1. Is it possible to recover files that have been deleted?

Sure. You just restore them from backups. (Sorry, couldn't resist. :-)

If you don't have backups it might be possible, if the data has not been
overwritten.

> 2. Which tools or procedures are suggested for recovery?

Try sysutils/sleuthkit [http://www.sleuthkit.org/].

<snip>
> Just after I noticed what I had done I unmounted the file system,
> powered off the machine and put the disk on the shelf (it's still
> there), no further write accesses.

You did the right thing here. Your information is probably still
there. It should probably be possible to restore the files, but it could
take a lot of effort. Use dd to make an image of the harddisk, and work on that.

Roland
-- 
R.F.Smith                                   http://www.xs4all.nl/~rsmith/
[plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated]
pgp: 1A2B 477F 9970 BA3C 2914  B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20090109/10f2fee7/attachment.pgp