On Sat, 16 Apr 2022 at 09:33 Sami Halabi <sodyn...@gmail.com> wrote: > how to do step 3 /? > > On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <gre...@freebsd.org> wrote: > >> Depends on the kind of file. >> >> You can always: >> 1. reboot the system into single user mode, mount the fs readonly >> (important to not overwrite data you want to recover) >> 2. dd the partition and into a file >> 3. find the content of the deleted file in the dump >> >> I was able to recover a complete codebase i deleted accidentally that way >> a long time ago. >> >> Good luck >> Michael >> >> On 16. Apr 2022, at 13:52, Sami Halabi <sodyn...@gmail.com> wrote: >> >> >> well.. thats the trivial answer.. the problem is backups is a day >> before... if i can undelete it would save me loss of 1 day offset.. >> >> anyone? >> >> On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <g...@unixarea.de> wrote: >> >>> El día sábado, abril 16, 2022 a las 02:23:25 +0300, Sami Halabi escribió: >>> >>> > Hi, >>> > is there anyway easy to restore deleted file by accident in UFS???? >>> >>> Yes, restore it from a backup media. >>> >>> matthias >>> >>> >>> -- >>> Matthias Apitz, ✉ g...@unixarea.de, http://www.unixarea.de/ >>> +49-176-38902045 >>> Public GnuPG key: http://www.unixarea.de/key.pub >>> >>> Peace instead of NATO! Мир вместо НАТО! Frieden statt NATO! ¡Paz en >>> vez de OTAN! >>> >>> >> >> -- >> Sami Halabi >> Information Systems Engineer >> NMS Projects Expert, FreeBSD SysAdmin Expert >> Asterisk Expert >> >> > > -- > Sami Halabi > Information Systems Engineer > NMS Projects Expert, FreeBSD SysAdmin Expert > Asterisk Expert >
Look at autopsy/photorec https://www.cgsecurity.org/wiki/PhotoRec_Data_Carving
