On Wednesday 11 May 2005 12:35, Hans du Plooy wrote:

Hi list,

I installed a iptables firewall + squid proxy on a client supplied box, on ext3 filesystem. They just realised that box had data on. It used to be a samba fileserver running on some version of FreeBSD -- I didn't really pay attention when I installed linux.

I can only assume you partitioned the disk when you began your set up. They should be able to -- at least -- tell you how the disk was previously partitioned and what the respective file system(s) were.

So my question, is there any chance of recovering anything that was on the BSD filesystem? The firewall has been running for a bout three days, not very heavy use at all. Only about the first gig or so of the disc has been used (squid cache, logs, ect), so hopefully the rest of the 80 gig disc might yield something.

I'd start with gpart and do my best to identify where on the disk previous partitions resided. More than likely, you're going to need some information from the client, with respect to previous partitions/file systems. I'd then dd those partitions out to another drive and begin my recovery. Check out Brian Carrier's Sleuthkit as well as foremost. http://www.sleuthkit.org/ http://foremost.sourceforge.net/ HTH -- Christopher Shanahan

If recovery is possible at all, can anyone point me to the type of tools I might need?

Thank you in advance -- Kind regards Hans du Plooy SagacIT (Pty) Ltd hansdp at sagacit dot com