Re: Tools/Techniques for recovering "rm"'d files

At 10:33 pm -0800 10/12/02, Dan Wood wrote:
> I've recently lost some very useful data due to "rm -rf *" in the 
> wrong directory, and I'd like to get as much of it back as possible. 
> I'm sure that "rm" doesn't zero out the bytes, but I'm having a heck 
> of a time recovering anything.
>
> I've tried both Norton Utilities and Prosoft's Data Rescue X, but it 
> looks like it's recovering files that were emptied from the trash, 
> not anything RM'd.
>
> I've found references to some unix utilities like unrm and lazarus 
> -- but does anybody know if there are OSX builds of these tools? 
> (No luck looking on Fink.)

The Coroner's Tool Kit is the source for these utilities. There is no 
reference to a Mac OS X build, but it has been tested on FreeBSD, 
OpenBSD and BSD, and is at least partly perl based (I've only run it 
under Solaris, and I can't remember its precise makeup).

The website is at <http://www.antioffline.com/TCT/>. There is also a 
walkthrough available on the site.

> Another idea is to somehow make a dump of my entire volume (perhaps 
> using disk copy to make a disk image) and then searching through the 
> file for familiar text patterns -- unfortunately, it's a 5 gig 
> volume, so that's a lot of wasted space and time!

This is essentially what unrm and lazarus do, but they attempt to 
make the searching easier.....

Cheers,

Joel
--

Joel Smith
22 Springfield Way
Pateley Bridge          Tel: +44 1423 711229    Mobile: +44 7768 803758
N.Yorks HG3 5PA         Fax: +44 870 1617192