Recover Deleted File FreeBSD 7.0

[Polytropon]

Hi!

On Thu, 14 Aug 2008 16:55:37 +0800, "Ruel Luchavez" <ruel.freebsd at gmail.com> wrote:
> Hi List,
> 
> Do you have an idea how to recover a deleted directory or files in freebsd
> 7.0?
> I'm very sad that one of the important directory in my server was deleted
> accidentally.
> the command is use to delete the directory is:
> 
> rm -r folder
> 
> 
> Any idea guys how to recover it?

I have the same probel, except that I hit PF8 in the Midnight
Commander which caused a recursion of unlink() to delete the files.

Of course I don't have a backup. :-(

As it has been mentioned by Diego F. Arias R., The Sleuth Kit
could offer some help. When TSK was TCT, there was a command
unrm which is dls today. Refer to

	% man dls

for further information, and assert enough disk space because I
think you have to work from an image. Furthermore, assert that
no writes go to the disk you want to recover deleted files from.

There's a good piece of documentation:

	% less /usr/local/share/doc/sleuthkit/ref_fs.txt

Maybe it's a bit explainatory and helpful.

First, make a dd copy of the partition, then run dls with the
proper options on it.

Sadly, I can't tell you more about this topic because I didn't
have any luck until today solving my similar problem.

Maybe you want to give back a little report when dls did work
for you?



-- 
Polytropon
>From Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...