Home » Mailing list archives » openbsd-misc » 2008 » July » 7

how to undelete?

Previous thread: Re: question regarding multipath routing by Stuart Henderson on Monday, July 7, 2008 - 6:43 am. (1 message)

Next thread: comixwall pf will not work by Rainel Roflo on Monday, July 7, 2008 - 3:22 am. (3 messages)
[view original message]
From: macintoshzoom <macintoshzoom@...>
To: <misc@...>
Subject: how to undelete?
Date: Monday, July 7, 2008 - 7:48 am

I deleted a directory from an OpenBSD slice from my 2nd HD, and I need

to recover a single file.


I tried : http://myutil.com/2008/1/15/undelete-unrm-for-openbsd-4-2-with-dls

but  failed :


# dls /dev/wd1x > /xxx/xx/undelete.bin

Sector offset supplied is larger than disk image (maximum: 0)


Help & thanks.
[view original message]
From: dermiste <dermiste@...>
To: <misc@...>
Subject: Re: how to undelete?
Date: Saturday, July 19, 2008 - 2:25 pm

You might want to try Photorec :

http://www.cgsecurity.org/wiki/PhotoRec


good luck
[view original message]
From: Die Gestalt <die.gestalt@...>
To: <misc@...>
Subject: Re: how to undelete?
Date: Monday, July 7, 2008 - 8:51 am

Just open your disk in a hex editor and look for your data, it should be here.
[view original message]
From: macintoshzoom <macintoshzoom@...>
To: Die Gestalt <die.gestalt@...>
Cc: <misc@...>
Subject: Re: how to undelete?
Date: Monday, July 7, 2008 - 3:30 pm

Which hex editor do you advise?

Should I have to umount the partition before?

the partition is 40 GB size on a secondary disk, OpenBSD old slice,

should I need at least such space (/tmp ?) to open it on the hex editor

from my OpenBSD 4.3?


Thanks!
[view original message]
From: Die Gestalt <die.gestalt@...>
To: <macintoshzoom@...>
Cc: <misc@...>
Subject: Re: how to undelete?
Date: Saturday, July 19, 2008 - 5:23 am

There is a very nice hex editor specialized in forensics called

WinHex, but it runs on Windows. I don't know if there is an equivalent

tool in the *nix world.
[view original message]
From: Nick Guenther <kousue@...>
To: Die Gestalt <die.gestalt@...>
Cc: <misc@...>
Subject: Re: how to undelete?
Date: Saturday, July 19, 2008 - 10:18 am

hexdump -C?
[view original message]
From: Sviatoslav Chagaev <slava@...>
To: Nick Guenther <kousue@...>
Cc: <misc@...>
Subject: Re: how to undelete?
Date: Saturday, July 19, 2008 - 10:00 am

On Sat, 19 Jul 2008 10:18:19 -0400


bvi ( http://bvi.sourceforge.net/ )
[view original message]
From: Leonardo Rodrigues <leonardovcr2@...>
To: <misc@...>
Subject: Re: how to undelete?
Date: Thursday, July 10, 2008 - 2:40 am

If I'm not mistaken, openbsd zeroes the data when you delete a file.

I remember trying to recover a file and then receiving a 0Kb file =)


If you still want to try, you could try using the sleuth kit

(available in ports) to recover something.
[view original message]
From: Henning Brauer <lists-openbsd@...>
To: <misc@...>
Subject: Re: how to undelete?
Date: Thursday, July 10, 2008 - 7:14 am

no, that would be pointless.


--

Henning Brauer, hb@bsws.de, henning@openbsd.org

BS Web Services, http://bsws.de

Full-Service ISP - Secure Hosting, Mail and DNS Services

Dedicated Servers, Rootservers, Application Hosting - Hamburg & Amsterdam
[view original message]
From: David Vasek <vasek@...>
To: Henning Brauer <lists-openbsd@...>
Cc: <misc@...>
Subject: Re: how to undelete?
Date: Thursday, July 10, 2008 - 8:03 am

For the archives: unless it is specifically requested as

rm -P


Regards,

David
[view original message]
From: Gordon Grieder <grub@...>
To: David Vasek <vasek@...>
Cc: Henning Brauer <lists-openbsd@...>, <misc@...>
Subject: Re: how to undelete?
Date: Thursday, July 10, 2008 - 10:23 am

For some unknown reason this prompted me to look at the rm manpage for the

hell of it (yeah, bored and tired at the moment). There's an odd comment in

the STANDARDS section which says


    "The interactive mode used to be a dsw command, a carryover from the an-

    cient past with an amusing etymology."


That piqued my interest further (yeah, still bored and still tired at the

moment) so I googled away and found this tidbit about the mysterious dsw

command: http://dvlabs.tippingpoint.com/blog/2008/03/18/a-bit-of-history


 Gord
[view original message]
From: Marco Peereboom <slash@...>
To: macintoshzoom <macintoshzoom@...>
Cc: <misc@...>
Subject: Re: how to undelete?
Date: Monday, July 7, 2008 - 8:29 am

You use a backup.


UNIX != Windows != OSX
Previous thread: Re: question regarding multipath routing by Stuart Henderson on Monday, July 7, 2008 - 6:43 am. (1 message)

Next thread: comixwall pf will not work by Rainel Roflo on Monday, July 7, 2008 - 3:22 am. (3 messages)