![](https://seccdn.libravatar.org/avatar/4f3bb0017bb9968b01a4afe2dd1892ca.jpg?s=120&d=mm&r=g)
On Thu, 2003-08-21 at 16:14, Daniel Coll wrote:
Hi, I have erase some files using the rm command in console. I have read that there are some ways to recover it, but not the 100% of the data. Is there any software or methot to asure a greater chance. I am using suse 8.2. Thank you DMC
I don't know of anything offhand, but my company does Computer Forensics (CF) on Win32 machines and the issue comes up there pretty often. I think there are some CF tools that can do Linux FS's, but it very much depends on the filesystem and how much activity your system has had since the rm. I would unmount the drive (or shutdown) as fast as possible. Then use dd to create a duplicate of the filesystem for you to tinker with. Save the original for another try in case you screw up the copy. If it is the root filesystem, then reboot into single user mode (i.e. readonly for root fs.) Then do a dd onto a new blank disk. Then maybe you can use some CF tools to recover part/all of your data. You can find a modified Knoppix boot CD at www.linux-forensics.com/downloads.html That CD has a bunch of CF tools on it. Maybe one of them can help. In particular I would look at (they are on the CD): Sleuth Kit - Command Line Forensic Tools - www.sleuthkit.org autopsy - Part of Sleuth Kit foremost - Command line data carving tool. Config file in /foremost directory. Need external storage to run properly - foremost.sourceforge.net glimpse - Command line data indexing and searching tool. Need external storage to run properly - www.webglimpse.net HTH Greg -- Greg Freemyer