On 10/1/06, Joachim Schipper <[EMAIL PROTECTED]> wrote:
On Sat, Sep 30, 2006 at 07:24:43PM +0200, Bambero wrote:
> Hello
>
> I need to recovery overwritten txt file.
>
> Ex.
> echo "my data" > testfile.txt
> echo "" > testfile.txt
>
> I have partition image file creted using dd.
> Is it possible to dump it and search using grep for example ?
> Is it possible to recover overwritten data ?
Well, let this teach you about the values of good backups. amrecover
(AMANDA) is considerably friendlier than what you're about to go
through... (and I can attest to both from personal experience. Ouch.)
I only backup my large repositories and media once a month. 29 days of
work is worth hunting for.
You're quite lucky, though, to have deleted a plain text file. Provided
you still know a couple of words, you could search for them. grep -A
would work, but be careful to redirect it or it'll mess up your
terminal.
(I dont see how grep would help here)
Tools like TCT (The Coroner's Toolkit, by Wietse Venema &c) or The
Sleuth Kit (more modern; apparently, Autopsy is something of a GUI for
it) could help a lot, if you're desparate.
Joachim
hexedit works just fine for this purpose imo.
http://archives.neohapsis.com/archives/openbsd/2005-01/1717.html
It is very safe to use, and free (as in COST, it is probobly gnu, not
meeting my own concept of 'free').
