[aklug] Re: UNDELETE

After you confirm you have a good image, you can probably get it all back
with photorec, but you will end up with a mess of files in numeric order in
folders according to filetype. Just giving you a heads up in case you grab
that as the first try tool. Again, as was mentioned, once you have a good
image then use your tools on the image. Make a couple if you are worried
about screwing it up and you have space/time to do it.

Above all... do not write ANYTHING to the drive. If it is the boot drive or
a scratch drive or anything, you better unmount it. Most file systems work
in a last deleted first overwritten kind of scheme, overly simplified of
course.

Good luck!

 _____ _____
/\___ \/\ __`\
\/__/\ \ \ \_\ \
   _\ \ \ \ ,__/
  /\ \_\ \ \ \/
  \ \____/\ \_\
   \/___/ \/_/

907-748-2200JP Technical <http://www.jptechnical.com/>helpdesk@jptechnical.com

On Tue, Mar 4, 2014 at 2:31 PM, Greg Schmitz <greg@amipa.org> wrote:

> On 3/4/14 1:42 PM, Greg Schmitz wrote:
>
>>
>> Not sure of away to perform a recovery, but you probably should back-up
>> or image the disk before you move ahead with more serious work on the
>> drive. I would suggest using gnu ddrescue to create a true image of
>> whatever may still be on your disk.
>>
>> --greg
>>
>
> see for example: http://www.forensicswiki.org/wiki/Ddrescue
>
> ---------
> To unsubscribe, send email to <aklug-request@aklug.org>
> with 'unsubscribe' in the message body.
>
>

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Tue Mar 4 22:28:51 2014