BB Cao wrote: > Hi All, > > I accidently delete all my files under a directory by > using "rm *". Are there any way recoverying them? > Thanks. Gavin Henry wrote: > http://www.sleuthkit.org/ BB Cao replied: > Thanks! Any other tips since I am a normal user > without root authority and the su is out of town for > weekend? Probably a bit late now, but turn the computer off. Don't allow those disks to be remounted until something like sleuthkit has been run. If you have physical access to the machine, you may be able to run sleuthkit from a CD-based OS like Knoppix, or take the hard drive out, put it into another PC, and make *very* sure that you're NOT booting from the hard disk with deleted files. If you continue to use the disk, then the deleted files will increasingly be overwritten by other stuff that is being saved. And then it will be practically impossible to get the data back. Some Data Recovery firms claim to be able to recover overwritten data. I seem to remember someone from an IT website tested them, and found that their success rate was practically nonexistent. I can't find a link at the moment. Your only other option is to convince your national authorities that you are an Al Qaeda operative. Hopefully they or someone like the NSA will attempt to recover everything they can from the drive (and if anyone can recover over-written data, they can). When they find that there is nothing suspicious there, you *may* be able to convince them to give you a copy of the data. If you are *amazingly* persuasive... Good luck! James. -- E-mail address: james | Q. "Why can't I print?" @westexe.demon.co.uk | A. "Because you're not a printer." | -- Stephen Judd
