On Wednesday 17 October 2007, Dan Farrell wrote: > On Wed, 17 Oct 2007 01:10:33 +0200 > > dexter <[EMAIL PROTECTED]> wrote: > > Mick pisze: > > > On Tuesday 16 October 2007, Duane Griffin wrote: > > >> On 15/10/2007, Neil Bothwick <[EMAIL PROTECTED]> wrote: > > >>> On Mon, 15 Oct 2007 23:26:02 +0200, dexter wrote: > > >>>> While tar-ing it I've messed up the command and file got deleted > > >>>> - I need it back desperately > > >>> > > >>> emerge testdisk and run photorec. > > >> > > >> But be sure it doesn't compile on the same partition that contained > > >> the lost data! > > > > > > Suggest you try testdisk with a LiveCD and stop messing about with > > > the drive in question in case you overwrite the disk space in > > > question. > > > > Unfortunatelly it is impossible to use live cd, so is not messing > > with hard drive - there are services on it that must remain online > > I've asked around, and found pretty cool solution > > > > on another system I do: nc -l -p 21 > drive_image.dd > > on server with deleted file I do: dd if=/dev/hda1 | nc -q 2 <ip of > > another system> 21 > > > > after that I can play around with drive_image.dd using for example > > autopsy > > I'm afraid I don't think that's going to work too well for you. You > see, hardware diagnostics generally employ methods of reading older > data on the drive because it leaves some kind of electromagnetic > 'residue' on the drive. In other words, the diagnostic access you need > requires access to the hard drive you want to diagnose.
Sure, but *software* diagnostics (testdisk) should do what the OP wants. Creating a drive/partition image and mounting on another machine using loopback will work fine (I have done it myself a number of times). Recovery may be less effective if the original disk are has been overwritten by newer data. -- Regards, Mick
signature.asc
Description: This is a digitally signed message part.
