On Fri, Jan 09, 2009 at 12:28:46AM +0100, Polytropon wrote: > Hi, > > I'd like to ask a two-stage question: > > 1. Is it possible to recover files that have been deleted?
Sure. You just restore them from backups. (Sorry, couldn't resist. :-) If you don't have backups it might be possible, if the data has not been overwritten. > 2. Which tools or procedures are suggested for recovery? Try sysutils/sleuthkit [http://www.sleuthkit.org/]. <snip> > Just after I noticed what I had done I unmounted the file system, > powered off the machine and put the disk on the shelf (it's still > there), no further write accesses. You did the right thing here. Your information is probably still there. It should probably be possible to restore the files, but it could take a lot of effort. Use dd to make an image of the harddisk, and work on that. Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
pgpUJIfyGIdR1.pgp
Description: PGP signature
