Professional Web Applications Themes

Data Recovery - FreeBSD

Are there any ways to recover files from rm -rf dirname after a few days, assuming there have been few if any writes to the filesystem since? I've been playing with tools like foremost and jpegrescue a bit... and running tests on other filesystems, but it doesn't appear that I'm getting full images back from the disk. Looking at an octal dump of a disk image (dd if=/dev/blah of=/some/file), I can find the file header... and about 20k of the file, generally... and then there's garbage. Presumably the file's been broken into blocks and there's inode table data to consider... ...

  1. #1

    Default Data Recovery


    Are there any ways to recover files from rm -rf dirname after a few
    days, assuming there have been few if any writes to the filesystem since?

    I've been playing with tools like foremost and jpegrescue a bit... and
    running tests on other filesystems, but it doesn't appear that I'm
    getting full images back from the disk. Looking at an octal dump of a
    disk image (dd if=/dev/blah of=/some/file), I can find the file
    header... and about 20k of the file, generally... and then there's
    garbage. Presumably the file's been broken into blocks and there's
    inode table data to consider...

    The tests I"m running are trying to find jpeg files that HAVEN'T been
    deleted from the filesystem. My real scenario of course differs.

    Pointers/rtfm welcome.

    -Yanek.
    Yanek Guest

  2. #2

    Default Re: Data Recovery

    I hope that you have remounted this filesystem read-only .. or else you
    might not be able to recover anything. That might be one of the problems
    you are running into.

    Sleuthkit allows you to search inodes and fragment ranges of a device for
    particular file and directory names.. then images that inode or fragment
    range into a single image file elsewhere on the system.

    Foremost will then open that image file and extract files based on their
    header and footer information, but.. if you do not include footer
    information you might get truncated file recovery. Also.. as stated
    before.. if there have been multiple writes to the file system.. you
    probably wont get the file back at all.

    Hope this helps..

    T
    ----- Original Message -----
    From: "Yanek Korff" <com>
    To: <org>
    Sent: Thursday, March 17, 2005 10:24 AM
    Subject: Data Recovery

     


    Thomas Guest

  3. #3

    Default Re: Data Recovery

    Yanek Korff writes:
     

    You can restore the files from backup for as long as you keep the
    backups.

    --
    Anthony


    Anthony Guest

Similar Threads

  1. HELP - data recovery tool
    By Mike in forum Windows Server
    Replies: 3
    Last Post: July 28th, 05:53 PM
  2. Colossal up - data recovery suggestions please?
    By Raving in forum Mac Applications & Software
    Replies: 18
    Last Post: September 7th, 04:25 PM
  3. data recovery ext3 (was Recover zip file via Archive::Zi p)
    By William M West in forum PERL Beginners
    Replies: 0
    Last Post: August 8th, 01:58 PM
  4. recovery of deleted data files
    By gary in forum Windows XP/2000/ME
    Replies: 4
    Last Post: July 21st, 03:36 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139