Deleted File Recovery Through SSH

Matthew Frederico mfrederico at
Tue Feb 15 06:42:59 MST 2005

The only way you can recover deleted files (in my experience) is to
either dump and look at the /proc/kcore file (which is impossible in
FC) or to cat your whole HD to and grep through it for known content.

e.g.: # cat /dev/hda1 | grep "deleted.file"

These aren't eve sure fire ways, but it has helped me in the past
recover some files.

-- Matt

On Mon, 14 Feb 2005 14:37:13 -0700, Davis, Lawrence
<Lawrence.Davis at> wrote:
> Hello All,
>         How would I go about recovering deleted files through ssh? What
> tools can I upload to do this for me? I have no physical access to the
> server, so everything is done through ssh and scp. I'm not sure what cmd was
> executed to delete the files as it appears the server was hacked.
> Thanks,
> Lawrence Davis
> .===================================.
> | This has been a P.L.U.G. mailing. |
> |      Don't Fear the Penguin.      |
> |  IRC: #utah at   |
> `==================================='

-- Matthew Frederico

More information about the PLUG mailing list